The agreement, if approved by a federal judge, would end litigation over two distinct cybersecurity incidents in 2021 which affected over 2 million customers.