feat: improve tde

[Manuthor]

Features

PKCS#11

• Add cosmian_pkcs11_verify diagnostic binary (crate/clients/pkcs11/loader) that dynamically loads libcosmian_pkcs11.so via libloading and validates ckms.toml loading and KMS server reachability through the standard PKCS#11 C API (C_GetFunctionList → C_Initialize → C_GetSlotList → C_OpenSession → C_FindObjects per class → C_Finalize)
• Replace standalone cosmian_pkcs11 deb/rpm packaging with a signed cross-platform ZIP archive (cosmian-pkcs11-<variant>-<link-suffix>_<version>_<os>-<arch>.zip) containing libcosmian_pkcs11.{so,dylib}, cosmian_pkcs11_verify, and the public signing key; ZIP is built by .github/scripts/package/package_pkcs11_zip.sh, signed with GPG, and published to package.cosmian.com via the pkcs11-zip package type in the CI matrix
• Add OIDC/JWT bearer-token authentication mode for cosmian_pkcs11_verify: passing --token <JWT> causes a C_Login(CKU_USER, pin=<JWT>) call after C_OpenSession, enabling verification of KMS servers configured with pkcs11_use_pin_as_access_token = true; the token may also be supplied via the COSMIAN_PKCS11_TOKEN environment variable
• Support Oracle TDE wallet migration (software wallet ↔ HSM wallet): remove CKF_WRITE_PROTECTED from the token info flags in C_GetTokenInfo (Oracle checks this flag before calling C_GenerateKey during ADMINISTER KEY MANAGEMENT SET ENCRYPTION KEY … MIGRATE); add CKM_AES_KEY_GEN, CKM_AES_CBC, CKM_AES_CBC_PAD to the supported mechanism list; return correct flags in C_GetMechanismInfo (CKF_GENERATE for CKM_AES_KEY_GEN, CKF_ENCRYPT | CKF_DECRYPT for AES-CBC variants)