Add user-verification provider abstractions and RPC adapters (#43547)

## What changed

- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.

The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.

## Testing

Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.

GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81

codex-rs/app-server/src/user_verification_adapter_tests.rs

@@ -0,0 +1,33 @@
+//! Validates the wire-to-native boundary before any provider work can start.
+
+use super::*;
+use pretty_assertions::assert_eq;
+use serde_json::json;
+
+#[test]
+fn invalid_challenge_and_display_values_are_rejected_before_native_work() {
+    for (challenge, title, description) in [
+        ("".into(), "Approve".into(), String::new()),
+        ("AQ==".into(), "Approve".into(), String::new()),
+        (
+            URL_SAFE_NO_PAD.encode(vec![0; 4097]),
+            "Approve".into(),
+            String::new(),
+        ),
+        ("AQ".into(), String::new(), String::new()),
+        ("AQ".into(), "é".repeat(129), String::new()),
+        ("AQ".into(), "Approve".into(), "x".repeat(4097)),
+    ] {
+        let error = validate(rpc::UserVerificationVerifyParams {
+            challenge,
+            title,
+            description,
+        })
+        .err()
+        .unwrap();
+        assert_eq!(
+            error.data,
+            Some(json!({"type": "invalidRequest", "reason": "invalidParams"}))
+        );
+    }
+}