Add user-verification provider abstractions and RPC adapters (#43547)

## What changed

- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.

The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.

## Testing

Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.

GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81

codex-rs/user-verification/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "codex-user-verification"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+base64 = { workspace = true }
+p256 = { version = "0.13", default-features = false, features = ["arithmetic", "pkcs8", "std"] }
+sha2 = { workspace = true }
+thiserror = { workspace = true }
+
+[dev-dependencies]
+p256 = { version = "0.13", features = ["ecdsa"] }
+pretty_assertions = { workspace = true }
+
+[lib]
+doctest = false