Add a required xtask guard that fails on `#[deprecated]` items lacking a `Devolutions/IronRDP#` issue reference

Add a required CI/xtask lint (wired into the CI matrix, e.g. `xtask check deprecations`) that scans the workspace for `#[deprecated]` attributes and **fails** when a deprecation's `note` does not contain a `Devolutions/IronRDP#` issue reference. Every deprecated shim must be owned by a tracked removal issue; this guard enforces that policy mechanically so deprecations can't accumulate untracked.

This is a standalone, always-on guard — **not optional**. It has no dependency on the other issues in this effort, but it underpins the compatibility & deprecation policy used throughout it.

### Scope
- [ ] Add an `xtask` check that parses/greps the workspace for `#[deprecated(...)]` attributes and asserts each `note = "..."` contains a `Devolutions/IronRDP#` reference.
- [ ] Fail with a non-zero exit and a clear message naming the offending item (crate + path) when the reference is missing.
- [ ] Wire it into the CI matrix alongside the other `xtask check` steps.

### Acceptance criteria
- A `#[deprecated]` whose `note` lacks a `Devolutions/IronRDP#` reference fails CI.
- A `#[deprecated]` whose `note` includes a `Devolutions/IronRDP#` reference passes.
- The check runs as part of the standard CI sweep.

Start by locating the existing xtask check entry points and the CI matrix's standard xtask check steps. Implement the deprecation scan there, ensuring failures name the offending crate and path, then verify that missing references fail, valid references pass, and the check runs in the standard CI sweep.

Written by the indexing model from the issue text.