fix: Require user confirmation for P2_SHARED_SECRET privacy export

INS_PERFORM_PRIVACY_OPERATION (0x18) accepted P1_NON_CONFIRM for both
the public encryption key (P2=0x00) and the shared secret (P2=0x01).
The shared secret is computed via X25519 from the device-derived
private key and an attacker-supplied Curve25519 public key, so it is
secret material that should never leave the device without the user
physically approving the action. The non-confirm path turned the device
into a silent ECDH oracle reachable by any host that could send APDUs.

Reject P2_SHARED_SECRET + P1_NON_CONFIRM with
SWO_CONDITIONS_NOT_SATISFIED. The P2_PUBLIC_ENCRYPTION_KEY path keeps
its existing non-confirm semantics — that operation only exposes a
public key.

(cherry picked from commit 768e11a31f6511338d5c8b235f4bef3a4e32beeb)