feat: expose frontendRequest block on SessionData

[dobby-coder]

Summary

Since irmago v0.14.0, POST /session returns an extra frontendRequest block carrying an authorization token (plus protocol-version bounds). irmars previously dropped this field silently via serde. This PR exposes it so downstream consumers can drive the IRMA/Yivi frontend directly — most importantly to complete the pairing handshake, which has been mandatory by default for IRMA clients since v0.13.0.

Changes

• Add frontend_request: Option<FrontendRequest> to SessionData (serde rename = "frontendRequest", absent-tolerant via default, omitted on serialization when None).
• Add a new public FrontendRequest struct exposing:
  • authorization: String
  • min_protocol_version: Option<String> (minProtocolVersion)
  • max_protocol_version: Option<String> (maxProtocolVersion)
• Re-export FrontendRequest from the crate root.

Compatibility

Fully backwards compatible: servers older than v0.14.0 that omit the block deserialize to None. The optional protocol-version fields also tolerate servers that send only authorization.

Testing

• Added three unit tests covering: a full frontendRequest block, an absent block (older servers, asserts the field is skipped on serialize), and a block with only authorization.
• Extended the test_full_client_interaction integration test to assert frontend_request.authorization is present and non-empty.
• cargo test (unit), cargo clippy --all-targets, and cargo fmt --check all pass.
• Ran the full integration test suite locally against a real irmago v0.19.2 server — passes, confirming the real server populates the block and we deserialize it correctly.

Closes #6