fix: wipe credentials in the connect path and keep release builds out of dumps and debuggers

- Credential callbacks (SecretFn) now return Zeroizing<String>, as do the
  session-only/pending caches they read and the RDP client's password,
  so Nexus's own copies are wiped; a plain String copy is made only
  where a library API needs one (SSH password auth, IRC, VNC, CredSSP).
- Release builds disable core dumps (RLIMIT_CORE 0) and, on Linux, mark
  the process non-dumpable (PR_SET_DUMPABLE 0), which also blocks ptrace
  attach and /proc/<pid>/mem reads by other processes of the same user.
  Debug builds are unchanged so they stay debuggable. Verified on the
  release binary: core limit 0, /proc/<pid>/{environ,mem} root-owned and
  unreadable, local shells (including cwd capture) still work.

Closes the remaining parts of SEC-20261012-007 that the app controls;
egui's internal text buffers remain outside its reach.

rust/core/src/sessions/credentials.rs

@@ -55,29 +55,29 @@ impl Manager {
             if mode == SecretMode::Saved {
                 let mut st = state.lock();
                 if let Some(v) = st.pending.get(&key) {
-                    return Ok(v.to_string());
+                    return Ok(v.clone());
                 }
                 if !st.rejected.remove(&key)
                     && let Some(v) = secrets.get(&key)
                 {
                     st.used.insert(key.clone());
                     store.add_audit("secret.access", &pid, "", &format!("Accessed {kind} credential"));
-                    return Ok(v);
+                    return Ok(Zeroizing::new(v));
                 }
             }
             if mode == SecretMode::SessionOnly
-                && let Some(v) = state.lock().session_only.get(&key).map(|v| v.to_string())
+                && let Some(v) = state.lock().session_only.get(&key).cloned()
             {
                 return Ok(v);
             }
-            let v = prompt(&format!("Enter {kind}:"))?;
+            let v = Zeroizing::new(prompt(&format!("Enter {kind}:"))?);
             let mut st = state.lock();
             match mode {
                 SecretMode::Saved => {
-                    st.pending.insert(key.clone(), Zeroizing::new(v.clone()));
+                    st.pending.insert(key.clone(), v.clone());
                 }
                 SecretMode::SessionOnly => {
-                    st.session_only.insert(key.clone(), Zeroizing::new(v.clone()));
+                    st.session_only.insert(key.clone(), v.clone());
                 }
                 SecretMode::AskEveryTime => {}
             }