feat(vault): add key id validation

[quexten]

Adds validation for vault update requests. If a cipher is posted, if the key id is not present on either the user or the request, the validation succeeds. If the key id is present it must match.

This allows us to validate and prevent ciphers from being posted that are encrypted for the wrong key id. We will later remove the encrypted for user id, and it is marked obsolete.

https://bitwarden.atlassian.net/browse/PM-40814

[codecov]

Codecov Report

❌ Patch coverage is 93.75000% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.13%. Comparing base (eb43f28) to head (f65bc64).

Files with missing lines	Patch %	Lines
src/Api/Vault/Controllers/CiphersController.cs	93.33%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@              Coverage Diff               @@
##           tmp-part-3    #8184      +/-   ##
==============================================
- Coverage       67.53%   63.13%   -4.41%     
==============================================
  Files            2317     2317              
  Lines          100561   100547      -14     
  Branches         9051     9042       -9     
==============================================
- Hits            67911    63477    -4434     
- Misses          30358    34881    +4523     
+ Partials         2292     2189     -103     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the new EncryptedByKeyId field on CipherRequestModel and the extraction of the cipher encryption checks into ValidateCipherEncryptedForUser / ValidateCipherEncryptedByUser in CiphersController. The key id comparison correctly no-ops when either side is absent, mirroring MasterPasswordUnlockData.ValidateKeyIdUnchangedForUser, so old clients and users without a backfilled key id keep working. Malformed key ids are rejected with a 400 by [KeyId] via the global ModelStateValidationFilterAttribute before KeyId.FromHexEncodedString can throw, and the [Obsolete] EncryptedFor accesses are all pragma-guarded so the warnings-as-errors build stays clean. Unit test coverage spans the match, mismatch, field-absent, and user-has-no-key-id paths across Post, PostCreate, Put, and PutShare.

Code Review Details

• ❓ : Bulk share (PutShareMany) skips the key id check that single share enforces
  • src/Api/Vault/Controllers/CiphersController.cs:1201

[shane-melton]

Changes look good 🚀