validate token_type upon JSONRPC registration

Problem/Motivation

claude opus 4.8, confirmed by me:

 token_type not validated in the registration path

  registerOrRefreshToken() writes the caller-supplied $registration_token_type_plugin_id straight into the entity.
  Programmatic save() does not run the list_string allowed-values constraint, so any string is accepted. Later
  RegistrationToken::getTokenType() (Entity/RegistrationToken.php:207) calls $plugin_manager->createInstance($id); the
  manager has no fallback plugin (RegistrationTokenTypePluginManager.php), so an unknown id throws
  PluginNotFoundException and breaks any later send/validate for that token. A JSON-RPC caller can inject junk tokenType
  values → data-integrity / send-time errors.

  Fix: validate tokenType against token_type_manager->getAllowedValues() (or call $entity->validate()) and reject
  unknown types in AddPushToken or registerOrRefreshToken.