fix: wipe credentials in the connect path and keep release builds out of dumps and debuggers

- Credential callbacks (SecretFn) now return Zeroizing<String>, as do the
  session-only/pending caches they read and the RDP client's password,
  so Nexus's own copies are wiped; a plain String copy is made only
  where a library API needs one (SSH password auth, IRC, VNC, CredSSP).
- Release builds disable core dumps (RLIMIT_CORE 0) and, on Linux, mark
  the process non-dumpable (PR_SET_DUMPABLE 0), which also blocks ptrace
  attach and /proc/<pid>/mem reads by other processes of the same user.
  Debug builds are unchanged so they stay debuggable. Verified on the
  release binary: core limit 0, /proc/<pid>/{environ,mem} root-owned and
  unreadable, local shells (including cwd capture) still work.

Closes the remaining parts of SEC-20261012-007 that the app controls;
egui's internal text buffers remain outside its reach.

rust/core/src/sessions/mod.rs

@@ -838,7 +838,7 @@ mod tests {
         // Two separate resolutions (as two connects of the same session make) prompt once.
         for _ in 0..2 {
             let f = m.secret_fn("s1", &p.id, SecretKind::IrcNickServPassword, SecretMode::SessionOnly, counting_prompt(asked.clone()));
-            assert_eq!(f().unwrap(), "hunter2");
+            assert_eq!(f().unwrap().as_str(), "hunter2");
         }
         assert_eq!(asked.load(Ordering::SeqCst), 1);
         // Ask-every-time still prompts each time.
@@ -848,7 +848,7 @@ mod tests {
         // An explicit reconnect carries the cache to the new session id.
         let new = m.reconnect("s1").unwrap();
         let f = m.secret_fn(&new, &p.id, SecretKind::IrcNickServPassword, SecretMode::SessionOnly, counting_prompt(asked.clone()));
-        assert_eq!(f().unwrap(), "hunter2");
+        assert_eq!(f().unwrap().as_str(), "hunter2");
         assert_eq!(asked.load(Ordering::SeqCst), 2);
         m.close_all();
         let _ = std::fs::remove_dir_all(dir);