refactor: extract DPoPCredentialValidator from CredentialsManager

[sanchitmehtagit]

Summary

Note: this PR can go post V3 beta 1 release so keeping it in draft mode

• Extracts validateDPoPState(for:) and saveDPoPThumbprint(for:) from CredentialsManager into a new DPoPCredentialValidator struct
  in Auth0/DPoP/ for better separation of concerns
• simplify the logic
• added missing tests for ssoCredentials

Changes

New file: Auth0/DPoP/DPoPCredentialValidator.swift

A focused Sendable struct with three responsibilities:

• validate(for:) - pre-renewal DPoP state check (not configured → not present → thumbprint mismatch)
• saveThumbprint(for:) - persists or clears the thumbprint after store(credentials:)
• clearThumbprint() - removes the thumbprint entry on clear()

CredentialsManager.swift

• Removes validateDPoPState(for:) and saveDPoPThumbprint(for:) (~46 lines)
• Adds private let dpopValidator: DPoPCredentialValidator initialized in init
• All three call sites now delegate to self.dpopValidator.validate(for:)

Test plan

• swift build - no errors ✅
• Existing CredentialsManagerDPoPSpec tests cover all validation paths (notConfigured, keyMissing, keyMismatch, passes, thumbprint
  save/clear)
• No behaviour changes to passing tests - same error codes surface at the same call sites

[sanchitmehtagit]

closing this can be taken post major release on master branch