Pre-stable audit: security and cleanup tasks before beta

Problem/Motivation

Here are some findings from Claude Code's Opus 4.7's pre-beta audit of the 4.x branch. Each item below should land as its own commit referencing this issue so the upgrade story stays bisectable and reviewable. Severity tags reflect impact, not effort.

Security

• [SEC] XSS in NameFormatter::viewElements() — the user-supplied
  name is rendered as #markup and not escaped. Switch to #plain_text
  (or escape explicitly).
• No hook_entity_field_access() and no access handler. Either wire them up or remove the file
  to avoid misleading site builders.
• [SEC] Fingerprint stored as MD5 (SshKeyItem::onChange(); existing
  @todo in code). MD5 collisions are practical. Switch to the already-implemented
  Utils::getFingerprintSha256() and provide an update hook for existing rows.
• [SEC] No upper bound on the SSH-key value length. Storage column is
  text/big. Reject anything past a sane ceiling (e.g. 16 KB — covers RSA up to 16384-bit with a
  long comment) in SshKeyConstraintValidator or via a Length constraint in propertyDefinitions().

Cleanup

• Remove the scaffolding leftover foo in
  field.storage_settings.sshkey_default (config/schema/sshkey.schema.yml).
• Remove or wire up sshkey_theme() + theme_sshkey_fingerprint() — currently
  defined but no renderer calls them.
• Fix the misleading "entity property" comment in SshKeyItem::setValue() — left over from
  EntityReferenceItem.
• Resolve or file follow-ups for the three lingering @todo comments
  (SshKeyItem lines 18, 96; Utils line 37).
• Either consume Utils::getFingerprintSha256() from production code or remove it (relates
  to the MD5 item above).
• Grammar fix in sshkey.info.yml description: "to collect a ssh public keys" →
  "for SSH public keys".
• Reconcile the fingerprint property's setRequired(TRUE) with the storage
  schema's 'not null' => FALSE.
• Document (or constrain) that the same key is allowed across multiple entities — no unique index on
  fingerprint today.
• Replace generateSampleValue() with a real wire-format SSH key so devel-generate-style
  fixtures actually exercise the validator.

Validator coverage

• Structural validation for ed25519 / DSS is currently just a prefix match.
  phpseclib3\Crypt\PublicKeyLoader::load() can verify parseability for any algorithm — extend
  the validator past the prefix check.