Add user-verification provider abstractions and RPC adapters (#43547)

## What changed

- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.

The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.

## Testing

Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.

GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81

codex-rs/user-verification/src/guard_tests.rs

@@ -0,0 +1,32 @@
+//! Checks cancellation shared across queued operations and captured-identity callbacks.
+
+use super::*;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn identity_change_permanently_cancels_all_guard_clones() {
+    let identity_matches = Arc::new(AtomicBool::new(/*v*/ true));
+    let activity = Arc::clone(&identity_matches);
+    let guard =
+        UserVerificationRequestGuard::with_activity_check(move || activity.load(Ordering::Acquire));
+    let queued = guard.clone();
+    assert!(queued.check().is_ok());
+    identity_matches.store(/*val*/ false, Ordering::Release);
+    assert_eq!(
+        queued.check(),
+        Err(UserVerificationError::Cancelled {
+            reason: UserVerificationCancellationReason::Interrupted,
+            message: "the verification operation is no longer active".to_string(),
+        })
+    );
+    identity_matches.store(/*val*/ true, Ordering::Release);
+    assert!(!guard.is_active());
+}
+
+#[test]
+fn cancelling_one_clone_invalidates_queued_work() {
+    let guard = UserVerificationRequestGuard::default();
+    let queued = guard.clone();
+    guard.cancel();
+    assert!(!queued.is_active());
+}