ML-DSA (FIPS 204) post-quantum digital signatures

[WingZer0o]

Closes #50

Adds ML-DSA-65 (FIPS 204) signatures to the pqc module via the RustCrypto ml-dsa crate, following the module's existing free-function convention:

• pqc::ml_dsa::generate_signing_and_verification_key() -> MlDsaKeyPair — signing key serialized as its 32-byte seed
• pqc::ml_dsa::sign_message(message, signing_key) -> CasResult<Vec<u8>> — deterministic variant, empty context
• pqc::ml_dsa::verify_signature(message, signature, verification_key) -> CasResult<bool>

Errors map to existing CasError variants (InvalidKey, InvalidSignature, SigningFailed) — no changes to the FFI error-code contract.

Only the ML-DSA-65 parameter set is exposed, consistent with the single parameter set exposed for ML-KEM (1024) and SLH-DSA (Shake128f). Context strings, HashML-DSA, and hedged signing are out of scope.

Testing

• Round-trip sign/verify pass/fail tests in tests/pqc.rs
• Project Wycheproof known-answer tests (tests/data/ml_dsa/): 83 sign-seed vectors reproduced byte-for-byte, 203 verify vectors classified correctly
• Full suite (62 tests) passes locally in release mode

Also includes the AES-GCM-SIV commit already on this branch, plus a small cleanup renaming two misnamed SLH-DSA tests (hkdf_sha256_* → slh_dsa_sign_verify_*).

🤖 Generated with Claude Code