[DRAFT] Support ML-DSA context strings in signing and verification

[jakemas]

Issues:

Resolves: #1079
Depends on aws/aws-lc#3135.

Description of changes:

Add sign_with_context and verify_sig_with_context methods to PqdsaKeyPair and PqdsaVerificationAlgorithm respectively, allowing callers to specify FIPS 204 context strings (up to 255 bytes) for ML-DSA operations.

These methods use the existing EVP_PKEY_CTX_set_signature_context FFI binding (already available in aws-lc-sys) via the EVP_PKEY_CTX_consumer closure pattern. Empty contexts are equivalent to the existing context-free sign/verify methods.

Testing:

Update the mldsa_sigver_test macro to exercise verify_sig_with_context with test vector context strings. Add dedicated test covering round-trip sign+verify with context, mismatched context failure, empty context backward compatibility, >255 byte rejection, and max-length (255 byte) acceptance.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[justsmth]

Thanks for the PR!

Since this functionality won't be available in the upcoming "FIPS module 4.0", we'll need to think about how to expose this in our API. It will likely need to be locked behind our unstable feature until this functionality can be used when the "fips" feature is enabled.