Create `ironrdp-credssp-impl` (vetted sspi-backed backend)

The vetted default backend implementing the #1428 contract over the `sspi` crate.

> **Keep this PR additive.** Create the new crate; do **not** delete or move `ironrdp-connector/src/credssp.rs` (that happens in #1433). The logic is temporarily duplicated — connector keeps its own copy so it stays compilable — until the window closes.

### Scope
- [ ] New crate `ironrdp-credssp-impl` (deps: `ironrdp-credssp`, `sspi`, `picky*`). Port the logic of `ironrdp-connector/src/credssp.rs` here (leave the original in place — see the additive note above), plus the cert/key parsing (`picky`, `picky_asn1_x509`, `picky_asn1_der`) and the `KerberosConfig -> sspi::KerberosConfig` conversion.
- [ ] Implement `CredsspProvider`/`CredsspBackend` over `sspi::credssp::CredSspClient`.
- [ ] Implement `CredsspError` by mapping `sspi::Error` (`NStatusCode`) → `CredsspErrorKind` — preserve at least `WRONG_PASSWORD → WrongPassword` and `LOGON_FAILURE → LogonFailure` (what `ironrdp-web` distinguishes today).
- [ ] `supported_protocols()` advertises `HYBRID | HYBRID_EX`.

### Acceptance criteria
- Provides a drop-in default backend that reproduces current NLA behavior.

Start with ironrdp-connector/src/credssp.rs and the CredsspProvider/CredsspBackend contract from #1428. Create the additive ironrdp-credssp-impl crate, including the listed certificate and Kerberos conversion work, then verify that it provides the default backend, preserves the required error mappings, and advertises HYBRID | HYBRID_EX.

Written by the indexing model from the issue text.