feat: add XMLDSig signature builders

[polaz]

Problem

Signing needs a deterministic pure-Rust way to construct schema-valid XMLDSig Signature templates. The documented SignatureBuilder contract directly contains ReferenceBuilder values, so P2-010 and P2-011 must be delivered together.

Implementation

• Add SignatureBuilder and ReferenceBuilder public APIs using existing algorithm and transform types.
• Serialize namespace-correct XML with quick-xml.
• Enforce at least one reference and reject verify-only SHA-1 algorithms for signing templates.
• Preserve reference and transform insertion order.
• Support optional namespace prefix, Signature Id, Reference URI/Id/Type, and KeyInfo placeholder.
• Add parse-back, escaping, ordering, validation, and error-path tests.
• Update semver-compatible Rust dependencies in a separate commit.

Acceptance criteria

• Generated templates have XMLDSig namespace and required child ordering.
• Every Reference contains DigestMethod and empty DigestValue; Transforms remain ordered.
• Invalid XML prefixes, zero references, and SHA-1 signing algorithms fail explicitly.
• Unit, integration, doctest, clippy, check, and all-feature build are green.

Estimate

3d 4h (implementation 2d, tests/docs 1d, review overhead 4h)

Roadmap: P2-010, P2-011

[coderabbitai]

🔗 Related PRs

#9 - feat(xmldsig): add URI dereference for Reference elements [closed]
#20 - feat(xmldsig): add reference verification pipeline [closed]
#27 - feat(xmldsig): add ecdsa signature verification [closed]
#30 - feat(xmldsig): add full signature verify pipeline [closed]
#41 - test(xmldsig): add donor full verification suite accounting [closed]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!