Add a pluggable Edge Cookie provider seam with the built-in HMAC provider

[jwrosewell]

First of five PRs decomposing #838 into per-feature pieces, as requested in the review discussion, with the design specs in #986 as the review yardstick. Each PR targets main in sequence; #838 closes as superseded when the last piece lands. The five together reproduce #838's head byte for byte, so nothing appears or disappears in the split.

What this PR contains

• The EdgeCookieProvider trait: Edge Cookie minting, cookie read-back, and KV keying all route through the selected provider, so a vendor identifier round-trips verbatim instead of being dropped by the built-in shape check (accepts_id gates read-back and withdrawal, normalize_id_for_kv controls the KV key).
• The [ec] provider selector with per-provider [ec.providers.<key>] blocks. The hmac block carries the passphrase that previously lived on [ec]. With no provider selected, Trusted Server is stateless: nothing mints, and an existing identifier is treated as absent so it is never used or egressed, while the raw cookie value stays available to withdrawal handling.
• A request-evidence abstraction (crate::evidence) giving providers read access to the client IP, headers (including cookies), URL path, and query parameters.
• The adapter injection seam: RuntimeServices carries an optional vendor provider, so a vendor provider lives in its own crate and core never names it. A selected provider the adapter does not inject fails the request loudly rather than silently running stateless, and a provider block configured without a selector is rejected at startup.

Edge Cookie creation and use stay gated by the existing consent context exactly as on main; the permission model replaces that input in the third PR of this series.

Config migration

[ec] passphrase is rejected as an unknown field. Move it to [ec.providers.hmac] and select provider = "hmac" to keep minting. Log line changes: the per-request info field consent_allowed= becomes ec_allowed=.

Verification

cargo fmt --check, all six clippy targets with -D warnings, cargo test-fastly (1,843 core tests), test-axum, test-cloudflare, test-spin, and the cross-adapter parity suite all pass on this branch standalone. Tests include a verbatim round-trip with a non-default provider, evidence access at generate time, and opaque KV persistence.

Produced with AI assistance under James Rosewell's direction; needs human review.