Add link to reset remembered WAYF login-method choices

[kayjoosten]

What

Adds a "Login method choices" section to the bottom of the "my personal
data" page (/my-profile) that lets a user reset every per-application
WAYF login-method choice they've made, behind a confirmation popup.
Confirming sends the user to EngineBlock's /reset-remember-wayf
endpoint (OpenConext-engineblock#2085), which clears the cookie and
redirects back to this same page.

Closes #345.

Depends on OpenConext-engineblock#2097

/reset-remember-wayf needs to accept a redirect query parameter and
send a result signal back for this to fully work end-to-end; that's
OpenConext/OpenConext-engineblock#2097,
stacked on the already-open OpenConext-engineblock#2094. Without it,
this page's link still works, but the user is sent to EngineBlock's own
configured default afterwards instead of back here.

Scope note: this PR covers #345 only. #350 ("cookies have been
removed" feedback) and OpenConext-profile#346/#348 are intentionally out
of scope and deferred pending re-confirmation, per the epic's recommended
order.

Details

• WayfResetLinkBuilder is a small, pure service that appends a
  redirect query parameter (the absolute URL of this same page) to the
  configured wayf_reset_url. It's factored out of MyProfileController
  and unit tested in isolation, since this repo has no
  controller/functional test infrastructure and the interesting logic
  (building the link) doesn't need a kernel to test.
• New wayf_reset_url parameter follows the existing pattern of simple
  string config values in parameters.yaml(.dist), pointing at
  EngineBlock's reset endpoint.
• The new section reuses the shared modal.html.twig confirmation
  component (the same one used for deleting a connection), wrapped in a
  single-iteration for loop: the helper unconditionally derives its
  element ids from loop.index, which only exists inside a loop, and its
  one existing caller is always used from within a real loop over
  services.
• SCSS mirrors the structure/naming of the existing "Download" section on
  the SURFconext dashboard (mySurfConext__download*), including its
  IE11 fallback rules, since both are a text explanation next to a single
  button.
• New translation keys were added under the existing
  profile.my_profile key in all three locales (en/nl/pt). Exact copy
  from design mockups wasn't available to me, so the wording is a
  best-effort draft that should be reviewed against the actual designs
  before merging; the confirm button text ("Reset all") is the one piece
  of copy specified by the ticket itself.

Testing

All run inside the CI Docker image
(ghcr.io/openconext/openconext-basecontainers/php85-apache2-node24):

• composer check (validate, phplint, phpmd, phpcs, docheader, phpunit,
  phpstan): clean. 146/146 tests pass, including the new
  WayfResetLinkBuilderTest (100% coverage).
• bin/console lint:twig: 57/57 templates valid.
• yarn build (Encore/Sass): compiles cleanly (only pre-existing Sass
  deprecation warnings, unrelated to this change).

No controller/functional test was added for MyProfileController
itself, consistent with this repo's existing convention of not having
kernel/controller tests anywhere.