Support Jellyfin 12 alongside 10.11

Jellyfin 12 moved to .NET 10 and changed the IUserManager surface the
plugin relies on: Users/UsersIds became GetUsers()/GetUsersIds(),
ChangePassword takes a user id, HasPassword left the provider contract,
and the user cache is gone, so every lookup is a detached copy.

The plugin now multi-targets net9.0 (against 10.11.5) and net10.0
(against 12.0.0). The differences sit behind a JELLYFIN_12 constant in
Compat/UserManagerCompat.cs, whose ChangePasswordAsync also carries the
stored hash back onto the caller's instance: on 12 the UpdateUserAsync
that claims the account would otherwise write the stale null password
back over the one provisioning just set.

Each release ships one package per generation, with the fourth version
segment naming the target (x.y.z.11 and x.y.z.12) so a 12 server picks
the 12 package over the 10.11 one. scripts/package.sh wraps jprm for a
single generation and the workflows call it twice. The builder image
moves to the .NET 10 SDK, which builds both targets; the net9.0 test run
rolls forward onto the .NET 10 runtime.

CA1873 is a .NET 10 analyzer that flags the same log calls CA1848 does;
it is set to Info, as in the upstream Jellyfin 12 tree.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Jellyfin.Plugin.WatchedTogether/Auth/SharedAccountAuthenticationProvider.cs

@@ -136,12 +136,15 @@ public class SharedAccountAuthenticationProvider : IAuthenticationProvider, IReq
         throw new AuthenticationException("Invalid username or password.");
     }
 
+#if !JELLYFIN_12
     /// <inheritdoc />
     /// <remarks>
     /// A shared account always has a password in the sense that matters to Jellyfin: some member
     /// credential is required. Returning <c>false</c> would let clients offer a passwordless login.
+    /// Jellyfin 12 removed this hook from the provider contract along with passwordless logins.
     /// </remarks>
     public bool HasPassword(User user) => true;
+#endif
 
     /// <inheritdoc />
     /// <remarks>