feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

src/Cli/StellaOps.Cli/Services/PromotionAssembler.cs

@@ -13,6 +13,7 @@ using System.Threading;
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using StellaOps.Cli.Services.Models;
+using StellaOps.Cryptography;
 
 namespace StellaOps.Cli.Services;
 
@@ -29,11 +30,13 @@ internal sealed partial class PromotionAssembler : IPromotionAssembler
     };
 
     private readonly HttpClient _httpClient;
+    private readonly ICryptoHash _cryptoHash;
     private readonly ILogger<PromotionAssembler> _logger;
 
-    public PromotionAssembler(HttpClient httpClient, ILogger<PromotionAssembler> logger)
+    public PromotionAssembler(HttpClient httpClient, ICryptoHash cryptoHash, ILogger<PromotionAssembler> logger)
     {
         _httpClient = httpClient ?? throw new ArgumentNullException(nameof(httpClient));
+        _cryptoHash = cryptoHash ?? throw new ArgumentNullException(nameof(cryptoHash));
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
@@ -289,11 +292,10 @@ internal sealed partial class PromotionAssembler : IPromotionAssembler
         return null;
     }
 
-    private static async Task<string> ComputeFileDigestAsync(string filePath, CancellationToken cancellationToken)
+    private async Task<string> ComputeFileDigestAsync(string filePath, CancellationToken cancellationToken)
     {
         await using var stream = File.OpenRead(filePath);
-        var hash = await SHA256.HashDataAsync(stream, cancellationToken).ConfigureAwait(false);
-        return Convert.ToHexString(hash).ToLowerInvariant();
+        return await _cryptoHash.ComputeHashHexForPurposeAsync(stream, HashPurpose.Content, cancellationToken).ConfigureAwait(false);
     }
 
     private static (string name, string? tag) ParseImageRef(string imageRef)