`ironrdp-connector`: remove the deprecated CredSSP surface; drop `sspi`/`picky`

[CBenoit]

Converge: now that all consumers use the trait-based path (#1431) and the acceptor is off ironrdp-connector (#1432), delete the deprecated compatibility surface and make ironrdp-connector sspi-free. This closes the additive-deprecation window opened in #1430, and owns the removal of those shims per the compatibility policy.

Scope

• Remove the deprecated connect_* and the global ConnectorError/ConnectorResult (including the old Credssp(sspi::Error)); delete ironrdp-connector/src/credssp.rs and the old perform_credssp_step path in ironrdp-async/ironrdp-blocking. ConnectError is now the sole connect-flow error, and it is sspi-free (Credssp(Box<dyn CredsspError>)).
• Remove pub use sspi and the sspi/picky dependencies from ironrdp-connector.
• Remove ironrdp-web's residual old ConnectorError-based error arm.
• Add xtask guard: ironrdp-connector must not depend on sspi.

Acceptance criteria

• cargo tree -p ironrdp-connector -e no-dev -i sspi is empty.
• No #[deprecated] CredSSP shims remain in the workspace.
• With no backend injected, a server requiring NLA yields a clean "no CredSSP backend" error and HYBRID is never offered.