Implement V2 registration support (#7765)

* Implement V2 registration support

* Require the client version header on every login, like upstream

Every user login (password, user API key, SSO, including a first SSO login)
now needs the Bitwarden-Client-Version header, for V1 accounts too. V2
accounts need 2026.10.1, or 2026.10.2 for the desktop app, upstream's
current minimum.

* Escape the email in the client version log line

On a first SSO login the email comes from the identity provider and isn't validated yet, so a newline in it could add a line to the log.

migrations/mysql/2026-10-09-120000_user_crypto_v2/down.sql

@@ -0,0 +1,5 @@
+DROP TABLE IF EXISTS user_signature_key_pairs;
+
+ALTER TABLE users DROP COLUMN signed_public_key;
+ALTER TABLE users DROP COLUMN security_state;
+ALTER TABLE users DROP COLUMN security_version;

migrations/mysql/2026-10-09-120000_user_crypto_v2/up.sql

@@ -0,0 +1,14 @@
+ALTER TABLE users ADD COLUMN signed_public_key TEXT;
+ALTER TABLE users ADD COLUMN security_state TEXT;
+ALTER TABLE users ADD COLUMN security_version INTEGER;
+
+CREATE TABLE user_signature_key_pairs (
+    uuid                CHAR(36) NOT NULL PRIMARY KEY,
+    user_uuid           CHAR(36) NOT NULL UNIQUE,
+    signature_algorithm INTEGER  NOT NULL, -- 0 = ed25519, 1 = mldsa44
+    signing_key         TEXT     NOT NULL,
+    verifying_key       TEXT     NOT NULL,
+    created_at          DATETIME NOT NULL,
+    updated_at          DATETIME NOT NULL,
+    FOREIGN KEY (user_uuid) REFERENCES users (uuid) ON DELETE CASCADE
+);