Support the phishing-detection experimental client flag

[zu3st]

Bitwarden recently integrated a Phishing Blocker feature into its browser extension, warning users when visiting sites listed in the open-source Phishing.Database.

No Vaultwarden-specific server support is needed beyond exposing the experimental client feature flag phishing-detection. However, since Vaultwarden limits configurable client feature flags to a set hardcoded in config.rs, the feature currently cannot be enabled without a custom build.

This can be verified by adding phishing-detection to the accepted flag list, starting Vaultwarden with EXPERIMENTAL_CLIENT_FEATURE_FLAGS=phishing-detection, setting up the extension against that instance, and then visiting https://phishing.testcategory.com/. With that in place, the extension shows the phishing warning as expected.

Since this is already an upstream experimental client flag, adding it to Vaultwarden’s allowlist seems like a low-risk improvement that would let self-hosted users opt in without requiring any long-term stability guarantees.