Deduplicate client PIN entries

When a user mistypes their PIN, it can lead to them locking themselves out. I think it would be helpful for the user to notify them in the UI that they already attempted a PIN previously before sending it to the authenticator, wasting a PIN attempt.

Caching these can be a security issue. An attacker could want two things:

• to lock out the user and wipe their credentials
• to discover the PIN to find the credentials

This proposal doesn't change either threat, as in either case, the attacker would just use unique PIN attempts, or just take the device.

To avoid accidentally leaking these to logs though, we should hash the values in memory with a secret pepper in a tightly-controlled buffer. We can use the request ID as the salt. We should use the argon2 crate for hashing (using Argon2::new_with_secret(pepper, ...)).

Before we do this, we should use a combination prctl on credentialsd-ui to prevent core dumps and ptrace debugging from other processes, mlock to prevent saving the data to swap, and madvise to prevent core dumps during system crashes.

Start by locating the credentialsd-ui PIN submission path and reviewing how authenticator attempts and request IDs are handled. The issue provides no file or test entry point; completion would require an agreed design covering duplicate-attempt notification, protected in-memory hashing, and the stated anti-dump and anti-swap measures.