Add 3-D Secure (SCA) support for RecurlyJS 6.x

Problem/Motivation

The RecurlyJS module has no server-side 3-D Secure handling. When a customer's card requires 3DS authentication (mandatory in India, EU, and other regions), the subscription creation fails with no recovery path.

3DS support was started in D7 #3072689: [D7] Support 3D-Secure / PSD2 / SCA and D8 #3120230: [D8] Support 3D-Secure / PSD2 / SCA but never made it in to either branch.

This issue ports that functionality to the 6.x branch, updated for the v4 PHP client.

The implementation requires:
- Server-side detection of three_d_secure_action_required error from \Recurly\Errors\Validation
- Form rebuild with 3DS action token injected into drupalSettings
- Client-side recurly.Risk().ThreeDSecure() challenge in a modal
- Form resubmit with both original token and 3DS result token
- Support in both subscribe and update billing forms