Add user-verification provider abstractions and RPC adapters (#43547)

## What changed

- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.

The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.

## Testing

Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.

GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81

codex-rs/app-server/Cargo.toml

@@ -63,6 +63,7 @@ codex-shell-command = { workspace = true }
 codex-skills = { workspace = true }
 codex-skills-extension = { workspace = true }
 codex-utils-cli = { workspace = true }
+codex-user-verification = { workspace = true }
 codex-utils-pty = { workspace = true }
 codex-backend-client = { workspace = true }
 codex-file-search = { workspace = true }