Ensure credProtect level 3 uses high security wrapping by default

[wl336]

Summary

• default installation now leaves LOW_SECURITY_MAXIMUM_COMPLIANCE disabled so high-security credential wrapping is the norm
• restrict low-security wrapping selection to explicit opt-in and keep credProtect level 3 credentials on the high-security key unless configured otherwise
• add credProtect regression tests covering PIN requirements for level 3 and explicit maximum-compliance installs

Testing

• ./gradlew testJar
• python -m pytest python_tests/ctap/test_credprotect.py -k "credprotect_three_creation_requires_pin_when_pin_set or level_three_can_use_low_security_when_explicitly_enabled" (fails: missing smartcard/pyscard system dependency in environment)

---

Codex Task