Add post-quantum cryptography support with PqSoftCryptoProvider

- Implemented PqSoftCryptoProvider for software-only post-quantum algorithms (Dilithium3, Falcon512) using BouncyCastle.
- Added PqSoftProviderOptions and PqSoftKeyOptions for configuration.
- Created unit tests for Dilithium3 and Falcon512 signing and verification.
- Introduced EcdsaPolicyCryptoProvider for compliance profiles (FIPS/eIDAS) with explicit allow-lists.
- Added KcmvpHashOnlyProvider for KCMVP baseline compliance.
- Updated project files and dependencies for new libraries and testing frameworks.

ops/wine-csp/healthcheck.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Wine CSP Service Health Check
+#
+# Probes the /health endpoint to determine if the service is healthy.
+# Returns 0 (healthy) or 1 (unhealthy).
+
+set -euo pipefail
+
+WINE_CSP_PORT="${WINE_CSP_PORT:-5099}"
+HEALTH_ENDPOINT="http://127.0.0.1:${WINE_CSP_PORT}/health"
+TIMEOUT_SECONDS=8
+
+# Perform health check
+response=$(wget -q -O - --timeout="${TIMEOUT_SECONDS}" "${HEALTH_ENDPOINT}" 2>/dev/null) || exit 1
+
+# Verify response contains expected status
+if echo "${response}" | grep -q '"status":"Healthy"'; then
+    exit 0
+elif echo "${response}" | grep -q '"status":"Degraded"'; then
+    # Degraded is acceptable (e.g., CSP not installed but service running)
+    exit 0
+else
+    exit 1
+fi