Add keychain types for per-app access groups

[crazytonyli]

Note

First of a three-PR stack, followed by #25649 and #25650. Nothing in this PR is called by app code yet.

Description

The WordPress and Jetpack apps share a single keychain access group, and because it is the only group in the entitlements, every keychain item both apps write is cross-app by accident. This stack moves each app onto its own private access group, keeping the shared group only for the WordPress-to-Jetpack migration contract.

This PR adds the types, with no call sites yet:

1. AppKeychain scopes keychain access to the app's private group. Reads fall back to the legacy shared group during the transition, writes go to the private group only, and deletes clear both groups so a logout cannot be undone by the fallback read.
2. SharedKeychain is the explicit window into the legacy shared group. Its doc comment restricts it to the three migration call sites, which the next PRs wire up.
3. KeychainGroupMigrator performs a one-time, insert-only copy of the shared group into the private group, then sweeps the shared group's leftovers once both apps have recorded a copy at the current migration version.

[dangermattic]

	2 Warnings
⚠️	Modules/Package.swift was changed without updating its corresponding Package.resolved. If the change includes adding, removing, or editing a dependency please resolve the Swift packages as appropriate to your project setup (e.g. in Xcode or by running swift package resolve). If the change to the Package.swift did not modify dependencies, ignoring this warning should be safe, but we recommend double checking and running the package resolution just in case. .
⚠️	This PR is larger than 500 lines of changes. Please consider splitting it into smaller PRs for easier and faster reviews.

Generated by 🚫 Danger

[wpmobilebot]

📲 You can test the changes from this Pull Request in Jetpack by scanning the QR code below to install the corresponding build.

	App Name	Jetpack
	Configuration	Release-Alpha
	Build Number	32586
	Version	PR #25648
	Bundle ID	com.jetpack.alpha
	Commit	9149194
	Installation URL	3sm0v0ak744do

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[wpmobilebot]

🤖 Build Failure Analysis

This build has failures. Claude has analyzed them - check the build annotations for details.

[wpmobilebot]

📲 You can test the changes from this Pull Request in WordPress by scanning the QR code below to install the corresponding build.

	App Name	WordPress
	Configuration	Release-Alpha
	Build Number	32586
	Version	PR #25648
	Bundle ID	org.wordpress.alpha
	Commit	9149194
	Installation URL	6lgsn3ek7m6go

Automatticians: You can use our internal self-serve MC tool to give yourself access to those builds if needed.

[jkmassel]

Early review – there's a potential bug here if only one of the keychain deletions succeeds on logout. The app will still have a keychain entry, so on the next read I think it'll repopulate it?

I think the easiest fix here might just be to write a flag to UserDefaults when we copy from the shared keychain, then never do it again once that flag is written?