feat: add deviceBoundSessions fuse for Device Bound Session Credentials

[MarshallOfSound]

Description of Change

Adds an opt-in deviceBoundSessions fuse that lets websites bind sessions to a hardware-backed key (TPM on Windows, Secure Enclave on macOS), so a stolen cookie can't be replayed from another device.

• Fuse: FuseV1Options.EnableDeviceBoundSessions, off by default. On, it enables DBSC for every session and keeps sessions on disk for persistent partitions.
• Key service: runs in the browser process on every platform and is handed to the network service, so key operations stay out of the sandboxed network process.
• macOS: the keychain access group <TeamID>.<BundleID>.unexportable-keys is derived from the app's code signature. If the app is unsigned or lacks the entitlement, DBSC stays off and the reason is logged. In-memory partitions aren't supported.
• Software keys: with the fuse on, EnableBoundSessionCredentialsSoftwareKeysForManualTesting is ignored. With it off, that flag enables DBSC with mock keys for development, including Linux.
• Cookie clearing: clearStorageData / clearData with cookies now also end DBSC sessions, otherwise a session would re-issue the cleared cookie.
• DevTools: the Device bound sessions panel is enabled.
• Docs: fuse reference, macOS setup, and a code-signing note.
• Tests: 12 specs in fuses-spec.ts against a local HTTPS DBSC server, including rebinding after a network service restart.

Draft notes:

• Secure Enclave and TPM keys haven't been exercised yet; the specs use mock software keys.
• FuseV1Options.EnableDeviceBoundSessions (index 9) is added to @electron/fuses in feat: add FuseV1Options.EnableDeviceBoundSessions fuses#138, so the documented name resolves once that ships.

Checklist

• I have built and tested this change
• I have filled out the PR description
• I have reviewed and verified the changes
• npm test passes
• tests are changed or added
• relevant API documentation, tutorials, and examples are updated and follow the documentation style guide
• PR release notes describe the change in a way relevant to app developers, and are capitalized, punctuated, past tense, and no longer than 80 characters.

Release Notes

Notes: Added the deviceBoundSessions fuse for Device Bound Session Credentials.

[erickzhao]

API LGTM

[jkleinsc]

API LGTM

I think this is fine as a first step, but there are several things that probably should be addressed in follow ups:

1. There's no way to ask whether it worked. The fuse can be on and DBSC still be entirely inert. Maybe add something like session.isDeviceBoundSessionsAvailable().

2. No per-origin logout. cookies.remove() doesn't end a session; the only way out is clearing all cookies for the session. Chromium's DBSC service can enumerate and terminate individual session — none of that is surfaced.

3. session.clearData's cookies type now means also clearing device bound sessions. It makes sense given how they are tied together, but maybe we should add deviceBoundSessions.

4. No per-session granularity. Maybe we could add something like session.fromPartition(name, { deviceBoundSessions: true }).

5. No runtime observability. No events for register, refresh, or terminate.

[MarshallOfSound]

Agree on the potential follow ups. Specifically didn't want to expose new JS APIs here as they aren't required for actually surfacing the raw DBSC capability. Will look into JS APIs as a follow up