feat: enforce Bedrock identity envelopes

[robinbraemer]

Summary

• add opt-in bedrock-identity config with disabled, warn, and require modes
• add a core BedrockIdentityEnforcer around minekube:bedrock_identity envelope verification, replay protection, support-safe warnings, and require-mode rejection decisions
• wire enforcement into Velocity, Bungee, and Spigot before Connect rewrites local login/profile state
• extend the verifier so endpoint ID and org ID are optional expected scope fields for Connect Java, while the signed envelope still must contain them

Trust boundary note

Connect Java currently knows endpoint name and session ID locally, but not endpoint ID or org ID across both WatchService and libp2p login contexts. This PR therefore verifies the Moxy signature, session, protocol, endpoint name, and expected Bedrock policy. Full endpoint/org equality enforcement remains a follow-up once those IDs are carried into local login context or provided through key metadata.

Verification

Sequentially run after implementation:

• ./gradlew :core:test --tests com.minekube.connect.config.ConfigLoaderTest --no-daemon
• ./gradlew :core:test --tests com.minekube.connect.api.player.bedrock.BedrockIdentityVerifierTest --no-daemon
• ./gradlew :core:test --tests com.minekube.connect.bedrock.BedrockIdentityEnforcerTest --no-daemon
• ./gradlew :spigot:test --tests com.minekube.connect.addon.data.SpigotDataHandlerTest --no-daemon
• ./gradlew build --no-daemon
• git diff --check

Refs minekube/moxy#403
Refs minekube/moxy#396