Avoid phdr/payload copy on TBS

[maxtropets]

CborValue is convenient for handling owned vecs, but results in extra-copy for TBS construction.

This PR avoids that extra copy, and does not change the lib interface.

This also pins dependencies via commit hashes rather than tags for better reproducibility prospective.

[Copilot]

Pull request overview

This PR reduces allocations/copies during COSE Sig_structure (TBS) construction by switching from owned CborValue building to a borrowed-slice CBOR serialization path, while keeping the crate’s externally re-exported API unchanged.

Changes:

• Fixes an error message typo in sign_with_ctx.
• Introduces CborSlice + serialize_array for CBOR array serialization from borrowed data.
• Updates COSE sig_structure construction to serialize directly from phdr/payload slices to avoid intermediate Vec<u8> copies.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/sign.rs	Improves the signature-size error message text.
src/cose.rs	Uses borrowed-slice CBOR array serialization for TBS construction to avoid copying phdr/payload.
src/cbor.rs	Adds a small borrowed CBOR representation (CborSlice) and a helper to serialize an array without intermediate copies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.