feat: Implement DefaultCryptoHmac for compliance-aware HMAC operations

- Added DefaultCryptoHmac class implementing ICryptoHmac interface.
- Introduced purpose-based HMAC computation methods.
- Implemented verification methods for HMACs with constant-time comparison.
- Created HmacAlgorithms and HmacPurpose classes for well-known identifiers.
- Added compliance profile support for HMAC algorithms.
- Included asynchronous methods for HMAC computation from streams.

src/__Libraries/StellaOps.Cryptography/HmacPurpose.cs

@@ -0,0 +1,46 @@
+namespace StellaOps.Cryptography;
+
+/// <summary>
+/// Well-known HMAC purpose identifiers for compliance-aware cryptographic operations.
+/// Components should request HMAC by PURPOSE, not by algorithm.
+/// The platform resolves the correct algorithm based on the active compliance profile.
+/// </summary>
+public static class HmacPurpose
+{
+    /// <summary>
+    /// DSSE envelope signing and message authentication codes.
+    /// Default: HMAC-SHA256 (world/fips/kcmvp/eidas), HMAC-GOST3411 (gost), HMAC-SM3 (sm).
+    /// </summary>
+    public const string Signing = "signing";
+
+    /// <summary>
+    /// Token and URL authentication (e.g., signed URLs, ack tokens).
+    /// Default: HMAC-SHA256 (world/fips/kcmvp/eidas), HMAC-GOST3411 (gost), HMAC-SM3 (sm).
+    /// </summary>
+    public const string Authentication = "auth";
+
+    /// <summary>
+    /// External webhook interoperability (third-party webhook receivers).
+    /// Always HMAC-SHA256, regardless of compliance profile.
+    /// Every use of this purpose MUST be documented with justification.
+    /// </summary>
+    public const string WebhookInterop = "webhook";
+
+    /// <summary>
+    /// All known HMAC purposes for validation.
+    /// </summary>
+    public static readonly IReadOnlyList<string> All = new[]
+    {
+        Signing,
+        Authentication,
+        WebhookInterop
+    };
+
+    /// <summary>
+    /// Validates whether the given purpose is known.
+    /// </summary>
+    /// <param name="purpose">The purpose to validate.</param>
+    /// <returns>True if the purpose is known; otherwise, false.</returns>
+    public static bool IsKnown(string? purpose)
+        => !string.IsNullOrWhiteSpace(purpose) && All.Contains(purpose);
+}