feat(tbor): implement HKDF and single-step (X9.63 / SP 800-56A) KDF derivation - #589

Add three stateless masked-key TBOR crypto commands mirroring the MBOR
vault-key-handle equivalents:

- EccGenerateKey (0x17): generate an ECC keypair (P-256/384/521) and
  return the private key AEAD-GCM-256 masked under the requested scope
  plus the wire public key. Nothing is persisted on-device.
- EccSign (0x18): unmask a caller-held masked ECC private key in place,
  ECDSA-sign a host-supplied pre-hashed digest, return raw r||s.
- EcdhDerive (0x19): unmask a masked local ECC private key in place,
  derive an ECDH shared secret against a host peer public key, and
  re-mask the secret under a target scope.

Uses the zero-copy reserve+fill encoder and in-place unmask (decode_mut)
patterns. Recovered plaintext keys and derived secrets are scrubbed on
every return path (scope exit only resets the bump watermark). ECC import
is provided by the existing UnwrapKey (Ecc class); a cross-command test
covers UnwrapKey-Ecc -> EccSign.

Shared curve/kind mappings added to tbor from_pal (ecc_private,
ecdh_secret, ecc_private_curve); dispatch/classifier wiring in mod.rs and
op.rs. Wire schemas (fw + host mirror), emu integration tests (host-
verified ECDSA roundtrip for all curves), and per-command docs included.

Also harden the pre-existing RSA OAEP test
decrypt_rejects_corrupted_oaep_ciphertext: corrupting the most-significant
ciphertext byte can push the integer past the modulus, which OpenSSL reports
as INTERNAL_ERROR but CNG (Windows) reports as DDI_CMD_FAILURE. Accept either
rejection code so the platform-flaky test passes on Windows CI.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0b09e50a-a9be-4bae-b347-d42dc775a258

…erivation

Add two in-session TBOR KDF commands that derive key material from a
caller-held masked ECDH shared secret (from EcdhDerive) and return the
derived key masked under the requested scope — the KDF analogues of the
ECC crypto commands, re-masking the output instead of vaulting it:

- HkdfDerive (0x1C): HKDF (RFC 5869) with optional salt + info.
- ConcatKdfDerive (0x1D): single-step "concatenation" KDF, selecting
  ANSI X9.63 (SEC 1 §3.6.1) or NIST SP 800-56A r3 one-step (§5.8.2.1)
  via a kdf_alg discriminant; both take a single info octet string.

Both handlers unmask the ECDH secret in place, verify it is an ECDH
shared-secret kind carrying `derive`, run the KDF into scratch, mask the
output (AES / fixed- or variable-length HMAC) under the target scope, and
scrub the recovered secret and derived scratch on every path. The shared
KdfKeyType output-type enum moves to key_props (used by both commands).

Single-step KDF primitive (azihsm_crypto): the X9.63 and SP 800-56A
concatenation KDFs are implemented once, generically, over the shared
Hasher — they need nothing but a hash, so a single platform-agnostic
ConcatKdfAlgo serves both the OpenSSL (Linux) and CNG (Windows) backends
(unlike HKDF, which is per-backend). Known-answer tests validate both
variants against independently computed vectors (SHA-256/384/512, single-
and multi-block, absent info). The std PAL x963_kdf / sp800_56a_kdf hooks
(previously todo!() stubs) now delegate to it via a new StdKdf::concat_kdf;
the Uno PAL already implemented them. Adds HsmError::ConcatKdfError and
three CryptoError variants.

Wire schemas (fw + host mirror), dispatch / classifier / op.rs wiring
(in-session, session-id cross-checked, default-PSK gated) for both
opcodes. Emu tests cover every output key type under each KDF (and each
X9.63 / SP 800-56A variant), all hashes and scopes, optional salt/info,
and rejection of unknown hash / KDF variant / key type, variable-length
HMAC without / out-of-range length, and a non-ECDH-secret IKM. Per-command
docs added.

Based on tbor/ecc-crypto for the ECDH shared-secret input (EcdhDerive);
uses opcodes 0x1C / 0x1D after the sibling AES / ECC / RSA / Hash crypto
branches (0x15..0x1B).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 0b09e50a-a9be-4bae-b347-d42dc775a258

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: af077e4d-51d9-45f3-8e20-ea7f68813d17

Co-authored-by: jaygmsft <22506014+jaygmsft@users.noreply.github.com>