crypto: Migrate hash functionality from baselibs

[kssim]

Add SHA-256, SHA-384, and SHA-512 support across the public API, daemon, OpenSSL, and PKCS#11 providers. Preserve empty-input, streaming, reset, digest-size, and actionable error behavior.

Complete explicit and preferred provider selection, enforce stable wire values and request shapes, and keep provider validation failures retryable. Add known-answer, binary-input, provider, IPC/SHM, and integration coverage.

Document the QM boundary and the Baselibs consumer migration mapping.

Refs: #125

---

Key design decisions

• Preserve SHA256, SHA384, and SHA512 as canonical API identifiers.
  These identifiers were already used by the existing Crypto handlers and tests. Standard names such as SHA-256 remain in documentation, while changing the API identifiers would introduce unnecessary compatibility risks.

• Define a strict hash operation contract.
  Hash operations now use:

  • Init()
  • zero or more Update() calls
  • Finalize(output) or SingleShot(input, output)

  Hash-specific IPC parameters that had no clear meaning, such as IVs and optional data on Init() or Finalize(), were removed.

• Align streaming state behavior across providers.
  Calling Init() on an active context restarts the stream, Reset() returns it to idle, and SingleShot() is accepted only while idle. PKCS#11 explicitly aborts the previous token operation when restarting.

• Reject unknown algorithms instead of assuming a digest size.
  The previous fallback to 64 bytes was removed because it could hide configuration errors and result in incorrect buffer allocation.

• Apply provider preference using actual capabilities.
  HardwarePreferred and SoftwarePreferred may fall back when the preferred provider is unavailable or does not support the requested algorithm. Exact or explicitly selected providers do not silently fall back.

• Validate PKCS#11 token capabilities before context creation.
  A hash mechanism is accepted only when the selected token exposes the corresponding mechanism with the CKF_DIGEST capability.

• Do not reuse PKCS#11 sessions with uncertain state.
  If an active digest operation cannot be cleaned up, the session is discarded instead of being returned to the session pool.

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run --lockfile_mode=error //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.6.0) and connecting to it...
INFO: Invocation ID: 928b8969-c96c-4c47-978a-410583f41e19
Computing main repo mapping: 
Computing main repo mapping: 
DEBUG: Rule 'score_baselibs_rust+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-4kzcXcvGi9xBEEnrPOiSEvteITZMPKmK3MNgJXQIGtY="
DEBUG: Repository score_baselibs_rust+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'score_logging+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-/Q5+YfLkbMpz5PfvOkNS7qA3ehzth4emFhTcsk4q3zQ="
DEBUG: Repository score_logging+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'abseil-cpp+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-m3oGQwXp/ZTRJP+mzDWFkutCtdpYj7TgfQklSqQAhts="
DEBUG: Repository abseil-cpp+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
DEBUG: Rule 'protobuf+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-w6Cp7OiTLjHDtzbi2xixxC5wcM2biBOIsm0BqnHiTKI="
DEBUG: Repository protobuf+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
DEBUG: Rule 'grpc+' indicated that a canonical reproducible form can be obtained by modifying arguments integrity = "sha256-CvN7gAlTEwtHwHW1ZoPuYL3D7aPDf8YAQZP1tWl1ggQ="
DEBUG: Repository grpc+ instantiated at:
  <builtin>: in <toplevel>
Repository rule http_archive defined at:
  /home/runner/.bazel/external/bazel_tools/tools/build_defs/repo/http.bzl:431:31: in <toplevel>
Computing main repo mapping: 
Loading: 
Loading: 1 packages loaded
Loading: 1 packages loaded
    currently loading: 
Loading: 1 packages loaded
    currently loading: 
WARNING: Target pattern parsing failed.
ERROR: Skipping '//:license-check': no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
Analyzing: 0 targets (2 packages loaded)
ERROR: no such target '//:license-check': target 'license-check' not declared in package '' defined by /home/runner/work/inc_security_crypto/inc_security_crypto/BUILD
INFO: Elapsed time: 10.758s
INFO: 0 processes.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

[github-actions]

Documentation preview for this pull request is available at:
pr-237: https://eclipse-score.github.io/inc_security_crypto/pr-237/