[Feature Request] Only prompt for password when extracting encrypted data

Feature Description

Skip the master key (or macOS Keychain password) prompt when the requested categories don't require decryption.

Why is this feature needed?

Currently pickFromConfigs always resolves the keychain password regardless of which categories will be extracted. This forces users to enter their password (and triggers a confusing warning when it fails) even when no encrypted data is being requested.

Reproducer:

$ ./hack-browser-data dump -b safari -c cookie
Enter macOS login password:
[WRN] keychain unlock failed with provided password
[INF] Extracting Safari/default...

[INF] Exported to results/
[INF]   cookie.json              71 entries

Safari cookies are not encrypted — no password should be required.

This affects all browsers and platforms:

• Safari (macOS): cookies, history, bookmarks, downloads need no password
• Firefox (all): NSS is self-contained for non-password data
• Chromium (all): some categories like extensions and bookmarks could technically skip master key retrieval

Proposed Solution

Pass the requested categories down to pickFromConfigs and skip password resolution when none of the categories require it. Each browser type declares which categories need the master key.

Implementation sketch:

1. Add Categories []types.Category to PickOptions
2. In dump.go, parse categories before calling PickBrowsers and pass them in
3. In pickFromConfigs, only call resolveKeychainPassword when at least one selected browser+category combination requires decryption

Checklist

• I have checked the existing issues for similar requests.