[4.x] Add token-based security for cart loading

[lukeholder]

• Require valid token or logged-in cart owner to load a cart via load-cart action
• Add cartLinkExpiry setting (default 24 hours) for token expiration
• Add getLoadCartUrl() method to Carts service that generates secure token URLs
• Update Order::getLoadCartUrl() to return secure token URL
• Add email challenge flow for cart recovery when token is missing/expired
• Register commerce_cart_recovery system message for recovery emails
• Add _cart/email-challenge.twig and email-sent.twig templates
• Carts that have no email/custom associated and not address information will load without needing to check token etc.

[rlarabee]

Take a look at _getCart() in CartController.php as well because it is called by actionUpdateCart() and actionComplete() and any other cart modification actions, make sure the same validation is applied. I am not sure how this will affect the over all functionality, but from a cryptographic standpoint, for the generateCartNumber, I would move to something like bin2hex(random_bytes(16)).