feat(native): signing, validation & DID layer with zero-copy architecture

[JeromySt]

Layer 3 staged merge from native_ports onto native_ports_final.

Zero-Copy Architecture

Single-allocation parsing: CoseSign1Message wraps one Arc<[u8]> and all fields (headers, payload, signature) are Range into that buffer.

• CoseData::from_arc_range() — sub-view into parent buffer (0 alloc)
• parse_from_shared() / parse_from_arc_slice() — parse nested messages (e.g. receipts) sharing the parent's Arc with zero allocation
• ArcSlice::arc() / range() — expose backing buffer for downstream sharing
• LazyHeaderMap — deferred parsing via OnceLock, zero-copy ArcSlice/ArcStr values reference the parent buffer
• extract_receipts() returns Vec (no data copy)
• merge_receipts() deduplicates via HashSet (no byte copying)

Message Lifecycle (Composing → Signed)

• MessageState enum tracks mutability: Signed messages lock protected headers, payload, and signature
• set_unprotected_header() / remove_unprotected_header() — only mutation allowed post-signing, sets dirty flag
• encode() fast-path: clean signed messages return backing bytes directly
• encode_and_persist() — re-serializes and updates backing buffer
• CoseSign1Builder::sign_to_message() — produces Signed message directly

New Crates

Signing: cose_sign1_signing, cose_sign1_factories, cose_sign1_headers Validation: cose_sign1_validation, cose_sign1_validation_primitives,
cose_sign1_validation_test_utils
DID: did_x509
FFI: 7 C-ABI projection crates for all above

Handle-Based FFI (zero-copy across boundary)

15 new _to_message FFI functions return CoseSign1MessageHandle instead of copied byte buffers. C/C++ callers borrow data via accessor functions:

• cose_sign1_message_as_bytes() → *const u8 into Rust Arc
• cose_sign1_message_payload/signature/protected_bytes() → borrowed

C++ Projections (thin RAII, no allocations)

• ByteView struct replaces std::vector<uint8_t> for all byte accessors
• CoseSign1Builder::Sign() returns CoseSign1Message (RAII handle)
• Validator::Validate(const CoseSign1Message&) borrows message bytes
• CryptoProvider::SignerFromPem() / VerifierFromPem() — PEM key support

PEM Key Support

Added across Rust → FFI → C++ layers:

• EvpSigner::from_pem() / EvpVerifier::from_pem()
• cose_crypto_openssl_signer_from_pem() / verifier_from_pem()
• CryptoProvider::SignerFromPem(string/vector overloads)

Coverage

5,681 tests, 0 failures. Line coverage: 90.34% (gate: 90%).