fix: wipe credentials in the connect path and keep release builds out of dumps and debuggers

- Credential callbacks (SecretFn) now return Zeroizing<String>, as do the
  session-only/pending caches they read and the RDP client's password,
  so Nexus's own copies are wiped; a plain String copy is made only
  where a library API needs one (SSH password auth, IRC, VNC, CredSSP).
- Release builds disable core dumps (RLIMIT_CORE 0) and, on Linux, mark
  the process non-dumpable (PR_SET_DUMPABLE 0), which also blocks ptrace
  attach and /proc/<pid>/mem reads by other processes of the same user.
  Debug builds are unchanged so they stay debuggable. Verified on the
  release binary: core limit 0, /proc/<pid>/{environ,mem} root-owned and
  unreadable, local shells (including cwd capture) still work.

Closes the remaining parts of SEC-20261012-007 that the app controls;
egui's internal text buffers remain outside its reach.

rust/core/src/sessions/protocols.rs

@@ -125,11 +125,14 @@ impl Manager {
         let server_pass = if ic.server_password_required {
             self.secret_fn(id, &p.id, SecretKind::IrcServerPassword, ic.server_password_mode, prompt.clone())()
                 .map_err(|e| format!("IRC server password: {e}"))?
+                .to_string()
         } else {
             String::new()
         };
         let ns_pass = if ic.nick_serv_identify {
-            self.secret_fn(id, &p.id, SecretKind::IrcNickServPassword, ic.nick_serv_mode, prompt.clone())().map_err(|e| format!("NickServ password: {e}"))?
+            self.secret_fn(id, &p.id, SecretKind::IrcNickServPassword, ic.nick_serv_mode, prompt.clone())()
+                .map_err(|e| format!("NickServ password: {e}"))?
+                .to_string()
         } else {
             String::new()
         };
@@ -403,7 +406,7 @@ pub(super) fn connect_vnc_client(
         Ok(()) => Ok(c),
         // Ask for the password only when the server wants one.
         Err(e) if e.to_string().to_lowercase().contains("password") => {
-            cfg.password = Some(password()?);
+            cfg.password = Some(password()?.to_string());
             let c = clients::vnc::Client::new(cfg);
             c.connect()?;
             Ok(c)