refactor(fw): move hmac_hash to the shared ddi layer

[vsonims]

Summary

Groundwork for the TBOR HMAC command family (step 1 of the series; stacked on #578).

Relocates the HsmVaultKeyKind → HsmHashAlgo HMAC mapping (hmac_hash) out of the MBOR-only mbor::from_pal module up to the codec-neutral ddi module (alongside recover_bk_boot), so the upcoming TBOR HMAC handlers can reuse it via crate::ddi::hmac_hash without depending on mbor — matching the existing "shared helpers live at the command level, keeping tbor independent of mbor" convention.

Pure refactor — MBOR's Hmac handler now calls crate::ddi::hmac_hash; behavior is unchanged.

Note on resolve_masking_key

The originally-planned scope resolver is deferred to the next PR (with the first HMAC handler that consumes it). The existing masking-key call sites are intentionally key-id-based (they carry the Copy HsmKeyId across awaits/closures and fetch material at the use site to avoid borrow-checker conflicts), so a material-returning resolver fits the new handlers rather than a refactor of existing code — and adding it now would be dead code.

Validation

• MBOR HMAC emu 36/36 — fixed + var-len HMAC keys, all SHA-256/384/512 variants, sign-permission, KBKDF-derived, masked-key HMAC.
• cargo check + clippy clean; nightly fmt clean.

Base: #578 (tbor/session-mk-32). Will auto-retarget to main when #578 merges.

[vsonims]

Folded into #583, which is now based on main and bundles the hmac_hash move with the session-masking-key reshape and the RSA-AES key-unwrap commands. Closing to collapse the stack into a single PR.