Add post-quantum cryptography support with PqSoftCryptoProvider

- Implemented PqSoftCryptoProvider for software-only post-quantum algorithms (Dilithium3, Falcon512) using BouncyCastle.
- Added PqSoftProviderOptions and PqSoftKeyOptions for configuration.
- Created unit tests for Dilithium3 and Falcon512 signing and verification.
- Introduced EcdsaPolicyCryptoProvider for compliance profiles (FIPS/eIDAS) with explicit allow-lists.
- Added KcmvpHashOnlyProvider for KCMVP baseline compliance.
- Updated project files and dependencies for new libraries and testing frameworks.

src/Cli/StellaOps.Cli/Services/MirrorBundleImportService.cs

@@ -2,10 +2,10 @@ using System.Security.Cryptography;
 using System.Text.Json;
 using Microsoft.Extensions.Logging;
 using StellaOps.AirGap.Importer.Contracts;
-using StellaOps.AirGap.Importer.Models;
 using StellaOps.AirGap.Importer.Repositories;
 using StellaOps.AirGap.Importer.Validation;
 using StellaOps.Cli.Services.Models;
+using ImportModels = StellaOps.AirGap.Importer.Models;
 
 namespace StellaOps.Cli.Services;
 
@@ -238,10 +238,10 @@ public sealed class MirrorBundleImportService : IMirrorBundleImportService
         try
         {
             var envelopeJson = await File.ReadAllTextAsync(dsseFile, cancellationToken).ConfigureAwait(false);
-            var envelope = DsseEnvelope.Parse(envelopeJson);
+            var envelope = ImportModels.DsseEnvelope.Parse(envelopeJson);
 
             // Load trust roots if provided
-            TrustRootConfig trustRoots;
+            ImportModels.TrustRootConfig trustRoots;
             if (!string.IsNullOrWhiteSpace(trustRootsPath) && File.Exists(trustRootsPath))
             {
                 trustRoots = await LoadTrustRootsAsync(trustRootsPath, cancellationToken).ConfigureAwait(false);
@@ -287,7 +287,7 @@ public sealed class MirrorBundleImportService : IMirrorBundleImportService
         }
     }
 
-    private static async Task<TrustRootConfig> LoadTrustRootsAsync(string path, CancellationToken cancellationToken)
+    private static async Task<ImportModels.TrustRootConfig> LoadTrustRootsAsync(string path, CancellationToken cancellationToken)
     {
         var json = await File.ReadAllTextAsync(path, cancellationToken).ConfigureAwait(false);
         var doc = JsonDocument.Parse(json);
@@ -324,7 +324,7 @@ public sealed class MirrorBundleImportService : IMirrorBundleImportService
             }
         }
 
-        return new TrustRootConfig(path, fingerprints, algorithms, null, null, publicKeys);
+        return new ImportModels.TrustRootConfig(path, fingerprints, algorithms, null, null, publicKeys);
     }
 
     private async Task<List<string>> CopyArtifactsAsync(string bundleDir, string dataStorePath, MirrorBundle manifest, CancellationToken cancellationToken)