Add Bitwarden support and stop passing passwords on the command line

[FilipHert]

Summary

Adds Bitwarden as a second password manager alongside 1Password, and fixes the
way passwords are handed to the connection clients.

Connection passwords can now be stored as bw://<item-id> references, resolved
through the Bitwarden CLI at connect time. This works with bitwarden.com,
self-hosted Bitwarden and Vaultwarden.

Why a provider abstraction

OnePasswordProvider was referenced directly from the config manager, the
launcher and the GUI, and op:// was hard-coded in five places including
crypto.ShouldEncrypt. Rather than duplicate all of that, secret handling now
goes through a small secrets.Provider interface and a process-wide
secrets.Registry. 1Password behaves exactly as before; adding a third
provider later is a single file plus one line in Default().

The registry is a singleton because config.NewManager, launcher.NewLauncher
and MainWindow.openConfig each construct providers, and Bitwarden owns a
helper process that must exist only once.

How Bitwarden is reached

Bitwarden has no library interface, so the provider runs bw serve as a hidden
child process bound to 127.0.0.1 on a random free port and talks to its local
REST API. It starts lazily on first use and is stopped on exit. On Windows the
child is placed in a kill-on-close job object; on Linux it gets a parent death
signal. That matters because bw serve has no authentication of its own, so an
orphaned server would leave an unlocked vault reachable on loopback.

The child inherits BW_SESSION, so the user unlocks the vault once in their
shell. MremoteGO never asks for, sees or stores the master password. The
provider is written so a future POST /unlock dialog would be a small addition.

GUI

The add and edit connection dialogs share a new control group instead of
duplicating the 1Password block. It adds a Bitwarden... button that lists
and searches vault login items and writes back a reference, and a Store
password in Bitwarden option that creates a login item from a typed password.

The start-up authentication warning is now generic across providers, only asks
about providers the config actually references, and runs off the UI goroutine
because starting the CLI takes a second or two.

Security fix

Independently of Bitwarden, the connection password was visible in the process
list for the lifetime of the client process, so any local user could read it:

putty.exe -ssh ... -pw <password> host
sshpass -p <password> ssh ...
cmdkey /generic:TERMSRV/host /user:u /pass:<password>

• PuTTY now gets -pwfile with a private temporary file, which PuTTY itself
  recommends over -pw. The file is removed once the process is up, and files
  left by a killed run are cleaned at start-up.
• sshpass gets the password through SSHPASS. It cannot be set from Go
  because the terminal emulator hop does not forward the environment, so the
  generated snippet reads the file into the variable and deletes it before
  ssh runs.
• RDP credentials are written through the Credential Manager API. The blob is
  UTF-16LE, which is what mstsc expects; UTF-8 stores a credential that looks
  valid but silently fails to log in.

Known limitation, left alone deliberately: xfreerdp on Linux is still invoked
with /p:.

Testing

go test ./... was previously empty. This PR adds:

• the Bitwarden client and provider against a fake bw serve built on
  httptest, covering resolution, locked and unauthenticated vaults, item
  creation, list filtering and the absence of an Origin header, which the
  real server rejects;
• reference parsing, the provider registry, crypto.ShouldEncrypt and the
  password file handling;
• two tests that use the real system when available and skip otherwise: the
  Bitwarden CLI lifecycle, and a comparison proving the credential written
  through the API is byte for byte what cmdkey stores.

A go test ./... step was added to CI, and the Go version there was bumped from
1.23 to 1.24 to match go.mod.

Verified manually on Windows 11: build with CGO, GUI starts, bw:// resolution
reports a clear error with no login, no bw.exe left behind after exit.

Not addressed

ExtraArgs is still appended as a single argv element rather than split, which
predates this change.

🤖 Generated with Claude Code