feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

src/Attestor/StellaOps.Attestor.Verify/AttestorVerificationEngine.cs

@@ -11,21 +11,25 @@ using StellaOps.Attestor.Core.Options;
 using StellaOps.Attestor.Core.Storage;
 using StellaOps.Attestor.Core.Submission;
 using StellaOps.Attestor.Core.Verification;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Attestor.Verify;
 
 public sealed class AttestorVerificationEngine : IAttestorVerificationEngine
 {
     private readonly IDsseCanonicalizer _canonicalizer;
+    private readonly ICryptoHash _cryptoHash;
     private readonly AttestorOptions _options;
     private readonly ILogger<AttestorVerificationEngine> _logger;
 
     public AttestorVerificationEngine(
         IDsseCanonicalizer canonicalizer,
+        ICryptoHash cryptoHash,
         IOptions<AttestorOptions> options,
         ILogger<AttestorVerificationEngine> logger)
     {
         _canonicalizer = canonicalizer ?? throw new ArgumentNullException(nameof(canonicalizer));
+        _cryptoHash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
         _options = options?.Value ?? throw new ArgumentNullException(nameof(options));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
@@ -126,7 +130,7 @@ public sealed class AttestorVerificationEngine : IAttestorVerificationEngine
                 });
         }
 
-        var computedHash = Convert.ToHexString(SHA256.HashData(canonicalBundle)).ToLowerInvariant();
+        var computedHash = _cryptoHash.ComputeHashHexForPurpose(canonicalBundle, HashPurpose.Attestation);
         if (!string.Equals(computedHash, entry.BundleSha256, StringComparison.OrdinalIgnoreCase))
         {
             signatureIssues.Add("bundle_hash_mismatch");
@@ -806,14 +810,13 @@ public sealed class AttestorVerificationEngine : IAttestorVerificationEngine
         return buffer;
     }
 
-    private static byte[] HashInternal(byte[] left, byte[] right)
+    private byte[] HashInternal(byte[] left, byte[] right)
     {
-        using var sha = SHA256.Create();
         var buffer = new byte[1 + left.Length + right.Length];
         buffer[0] = 0x01;
         Buffer.BlockCopy(left, 0, buffer, 1, left.Length);
         Buffer.BlockCopy(right, 0, buffer, 1 + left.Length, right.Length);
-        return sha.ComputeHash(buffer);
+        return _cryptoHash.ComputeHashForPurpose(buffer, HashPurpose.Merkle);
     }
 
     private static bool TryDecodeSecret(string value, out byte[] bytes)