feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

docs/risk/samples/api/SHA256SUMS

@@ -0,0 +1,2 @@
+9408221415b389f6dad1c235de160e88721555b406ab0e2bdbfa3119c6696a4d  README.md
+96926cd81dfb6ff02d62d1fde5d7b2b7b5b3950e50eb651e51b8ae3042ac9506  risk-api-samples.json

docs/risk/samples/api/risk-api-samples.json

@@ -0,0 +1,61 @@
+{
+  "submit_job_request": {
+    "method": "POST",
+    "path": "/api/v1/risk/jobs",
+    "headers": {
+      "Content-Type": "application/json",
+      "X-Stella-Tenant": "tenant-default"
+    },
+    "body": {
+      "tenant_id": "tenant-default",
+      "context_id": "ctx-001",
+      "profile_id": "default-profile",
+      "findings": [
+        {
+          "finding_id": "finding-123",
+          "component_purl": "pkg:npm/lodash@4.17.20",
+          "advisory_id": "CVE-2024-1234",
+          "trigger": "created"
+        }
+      ],
+      "priority": "normal",
+      "requested_at": "2025-12-05T00:00:00Z"
+    },
+    "response": {
+      "status": 202,
+      "body": {"job_id": "job-001", "status": "queued"}
+    }
+  },
+  "get_job_status": {
+    "method": "GET",
+    "path": "/api/v1/risk/jobs/job-001",
+    "response": {
+      "status": 200,
+      "body": {
+        "job_id": "job-001",
+        "status": "completed",
+        "results": [
+          {
+            "finding_id": "finding-123",
+            "profile_id": "default-profile",
+            "profile_version": "1.0.0",
+            "raw_score": 0.75,
+            "normalized_score": 0.85,
+            "severity": "high",
+            "signal_values": {"cvss": 7.5, "kev": true, "reachability": 0.9},
+            "signal_contributions": {"cvss": 0.4, "kev": 0.3, "reachability": 0.3},
+            "scored_at": "2025-12-05T00:00:02Z"
+          }
+        ]
+      }
+    }
+  },
+  "get_explain": {
+    "method": "GET",
+    "path": "/api/v1/risk/explain/job-001",
+    "response": {
+      "status": 200,
+      "body_ref": "../explain/explain-trace.json"
+    }
+  }
+}