`ironrdp-connector`: remove the deprecated CredSSP surface; drop `sspi`/`picky`

Converge: now that all consumers use the trait-based path (#1431) and the acceptor is off `ironrdp-connector` (#1432), delete the deprecated compatibility surface and make `ironrdp-connector` sspi-free. This closes the additive-deprecation window opened in #1430, and owns the removal of those shims per the compatibility policy.

### Scope
- [ ] Remove the deprecated `connect_*` and the global `ConnectorError`/`ConnectorResult` (including the old `Credssp(sspi::Error)`); delete `ironrdp-connector/src/credssp.rs` and the old `perform_credssp_step` path in `ironrdp-async`/`ironrdp-blocking`. `ConnectError` is now the sole connect-flow error, and it is sspi-free (`Credssp(Box)`).
- [ ] Remove `pub use sspi` and the `sspi`/`picky` dependencies from `ironrdp-connector`.
- [ ] Remove `ironrdp-web`'s residual old `ConnectorError`-based error arm.
- [ ] Add xtask guard: `ironrdp-connector` must not depend on `sspi`.

### Acceptance criteria
- `cargo tree -p ironrdp-connector -e no-dev -i sspi` is empty.
- No `#[deprecated]` CredSSP shims remain in the workspace.
- With no backend injected, a server requiring NLA yields a clean "no CredSSP backend" error and HYBRID is never offered.

Start with ironrdp-connector/src/credssp.rs and the deprecated connect_* and ConnectorError/ConnectorResult surfaces, then trace the old perform_credssp_step path in ironrdp-async and ironrdp-blocking. Check ironrdp-web for its residual error arm and the workspace xtask checks. Done means the no-dev cargo tree has no sspi dependency, deprecated CredSSP shims are gone, and the stated NLA no-backend behavior holds.

Written by the indexing model from the issue text.