feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

src/Scanner/StellaOps.Scanner.WebService/Services/ReportSigner.cs

@@ -1,7 +1,6 @@
 using System;
 using System.Collections.Generic;
 using System.IO;
-using System.Security.Cryptography;
 using System.Text;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -29,6 +28,7 @@ public sealed class ReportSigner : IReportSigner
     private readonly string algorithmName = string.Empty;
     private readonly ILogger<ReportSigner> logger;
     private readonly ICryptoProviderRegistry cryptoRegistry;
+    private readonly ICryptoHmac cryptoHmac;
     private readonly ICryptoProvider? provider;
     private readonly CryptoKeyReference? keyReference;
     private readonly CryptoSignerResolution? signerResolution;
@@ -37,10 +37,12 @@ public sealed class ReportSigner : IReportSigner
     public ReportSigner(
         IOptions<ScannerWebServiceOptions> options,
         ICryptoProviderRegistry cryptoRegistry,
+        ICryptoHmac cryptoHmac,
         ILogger<ReportSigner> logger)
     {
         ArgumentNullException.ThrowIfNull(options);
         this.cryptoRegistry = cryptoRegistry ?? throw new ArgumentNullException(nameof(cryptoRegistry));
+        this.cryptoHmac = cryptoHmac ?? throw new ArgumentNullException(nameof(cryptoHmac));
         this.logger = logger ?? throw new ArgumentNullException(nameof(logger));
 
         var value = options.Value ?? new ScannerWebServiceOptions();
@@ -143,9 +145,8 @@ public sealed class ReportSigner : IReportSigner
             throw new InvalidOperationException("HMAC signing has not been initialised.");
         }
 
-        using var hmac = new HMACSHA256(hmacKey);
-        var signature = hmac.ComputeHash(payload.ToArray());
-        return new ReportSignature(keyId, algorithmName, Convert.ToBase64String(signature));
+        var signature = cryptoHmac.ComputeHmacBase64ForPurpose(hmacKey, payload, HmacPurpose.Signing);
+        return new ReportSignature(keyId, algorithmName, signature);
     }
 
     public void Dispose()

src/Scanner/StellaOps.Scanner.WebService/StellaOps.Scanner.WebService.csproj

@@ -9,7 +9,7 @@
     <RootNamespace>StellaOps.Scanner.WebService</RootNamespace>
   </PropertyGroup>
   <ItemGroup>
-    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0-rc.2.25502.107" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="10.0.0" />
     <PackageReference Include="Serilog.AspNetCore" Version="8.0.1" />
     <PackageReference Include="Serilog.Sinks.Console" Version="5.0.1" />
     <PackageReference Include="YamlDotNet" Version="13.7.1" />