1.0.0-beta4

Adds lazy on-login migration for brownfield sites, the bulk drain that finishes
it, and optional Key module integration for provider secrets.

Lazy migration moves an existing Drupal account into the IdP the first time its
owner logs in, using the password they just proved against the local hash, with
a pool-shape preflight and its own flood buckets around the write. Users who
never log in are handled by drush headless-idp:bulk-enrol, which provisions and
links the remainder without a credential; Cognito and Okta both implement it,
and Cognito's NEW_PASSWORD_REQUIRED challenge is now supported so an invited
user can complete their first sign-in.

Provider secrets can resolve from Key entities instead of exportable
configuration. A key reference always wins over the stored value and an
unresolvable one fails closed rather than falling back.

Also fixes three bugs in shipped code: the settings form blanked stored secrets
on re-save, provider subforms wrote each other's values, and Cognito silently
dropped the optional enrolment password.