Deduplicate client PIN entries

Dieses Issue hat noch niemand übernommen.

When a user mistypes their PIN, it can lead to them locking themselves out. I think it would be helpful for the user to notify them in the UI that they already attempted a PIN previously before sending it to the authenticator, wasting a PIN attempt.

Caching these can be a security issue. An attacker could want two things:
- to lock out the user and wipe their credentials
- to discover the PIN to find the credentials

This proposal doesn't change either threat, as in either case, the attacker would just use unique PIN attempts, or just take the device.

To avoid accidentally leaking these to logs though, we should hash the values in memory with a secret pepper in a tightly-controlled buffer. We can use the request ID as the salt. We should use the `argon2` crate for hashing (using `Argon2::new_with_secret(pepper, ...)`).

Before we do this, we should use a combination `prctl` on credentialsd-ui to prevent core dumps and ptrace debugging from other processes, `mlock` to prevent saving the data to swap, and `madvise` to prevent core dumps during system crashes.

Beginnen Sie damit, den PIN-Eingabepfad von credentialsd-ui zu lokalisieren und zu prüfen, wie Authentifikatorversuche und Anforderungs-IDs behandelt werden. Das Issue enthält weder einen Datei- noch einen Testeinstiegspunkt; für den Abschluss wäre ein abgestimmtes Design erforderlich, das die Benachrichtigung über doppelte Versuche, geschütztes Hashing im Speicher sowie die genannten Maßnahmen gegen anti-dump und anti-swap abdeckt.

Vom Indexierungsmodell aus dem Issue-Text verfasst.