Xendit moves to the Payment Sessions and v3 APIs

Commit message

[IMP] payment_xendit: migrate to Payment Sessions/v3 APIs, sync status on return, keep v2 tokens payable

Xendit is deprecating the v2/invoices and credit_card_charges endpoints for
new payments. This switches checkout and card sessions to the Payment
Sessions API (/sessions) and charges v3 tokens through /v3/payment_requests,
while still charging pre-existing v2 tokens through the legacy
credit_card_charges endpoint, as there is no migration path for them.

- the inline card form, its direct flow, and the Xendit SDK are removed; all
  payment methods now redirect to the Xendit-hosted payment link
- a v3 token charge that unexpectedly still requires 3DS exposes the
  authentication URL as a processing value; the frontend navigates the top
  window to it directly, since Xendit's challenge page must be top-level and
  only accepts GET
- a customer returning from checkout, or from a 3DS challenge, is checked
  directly against Xendit before falling back to pending, in case the
  webhook is delayed or dropped
- webhook payloads are unwrapped from their {event, data} envelope, and
  transactions are looked up by reference_id, falling back to external_id
  for legacy charges and to a suffix-stripped reference_id otherwise

Upgrade / stable-version compatibility:
- the inline_form view is emptied rather than removed (it's noupdate, and
  ondelete='restrict' would abort the module update otherwise); it is never
  rendered
- xendit_public_key is kept but unused, and several touched methods keep
  their old name or signature (_xendit_make_request, _xendit_create_charge,
  _xendit_prepare_invoice_request_payload, _get_redirect_form_view, the
  /payment/xendit/payment route), since partners may override them and a
  stable version can't drop or break an override
- bump the module version so partners upgrading notice the change

Webhook migration notice:
Xendit replaced the single webhook field with separate v3 event groups, so
already-configured databases silently stop receiving updates. Remind admins
once via the daily autovacuum cron (works without an upgrade or a new
ir.cron record), tracked through the payment_xendit.v3_notification_sent
system parameter so it's only sent once.

Task-6373405