Enforce a minimum RSA key length via a per-field setting

Problem/Motivation

RSA SSH keys remain widely used, but keys below 2048 bits are considered weak by modern standards (NIST
SP 800-131A, OpenSSH defaults). The SshKey field currently accepts any well-formed RSA key regardless of
modulus length. Administrators who want to enforce a minimum bit length must add their own validation or
rely on the SSH server to reject weak keys downstream.

Proposed resolution

Add a per-field setting min_rsa_bits (default 2048) that the validator enforces when an
incoming key uses the ssh-rsa algorithm:

1. Add the setting to SshKeyItem::defaultFieldSettings() and the field-settings form (a
   numeric input, visible when ssh-rsa is in the algorithm allowlist).
2. Pass it through SshKeyItem::getConstraints() as a constraint option.
3. Add a $minRsaBits property on SshKeyConstraint.
4. In SshKeyConstraintValidator::validate(), when the parsed algorithm is
   ssh-rsa, read the modulus from the base64-decoded payload, compute its bit length, and emit a
   violation if it is below the threshold.
5. Add a helper on Utils (e.g. getRsaModulusBitLength()) so the parsing logic
   stays out of the validator.
6. Update the config schema and add unit tests covering accept/reject at the boundary.

Bit length is computable from the public key alone — RSA public-key payloads carry the modulus as an SSH
mpint after the algorithm string and public exponent. No new dependency required.