KMS: add RSA_3072 and ECC NIST key specs with ECDSA signing

[damianh]

The KMS handler only supported SYMMETRIC_DEFAULT, RSA_2048, and RSA_4096, which blocked integration-testing JWT signing scenarios (RS384/PS384 and ES256/ES384/ES512) against MicroStack.

Changes

• RSA_3072: extends the existing RSA branch; reuses the current PKCS1/PSS signing algorithm list.
• ECC NIST keys: ECC_NIST_P256/P384/P521 create an ECDsa key alongside the existing RsaKey, exporting the public key as DER SubjectPublicKeyInfo. Each curve advertises its single matching algorithm (ECDSA_SHA_256/384/512).
• DER signatures: ECDSA Sign/Verify use DSASignatureFormat.Rfc3279DerSequence, matching real AWS KMS (ANSI X9.62 Ecdsa-Sig-Value), not IEEE P1363 raw r||s.
• Algorithm validation: Sign/Verify now validate the requested algorithm against the key's advertised SigningAlgorithms, returning ValidationException on mismatch (e.g. ECDSA_SHA_384 on a P-256 key) - this also tightens the previous RSA behavior.
• Sign-only enforcement: ECC keys require KeyUsage: SIGN_VERIFY at creation and reject Encrypt/Decrypt with ValidationException.

ECC_SECG_P256K1 is left out per the issue (optional, lower priority).

Testing

• New integration tests: RSA-3072 PKCS1/PSS SHA-384 round trips with public key import, a theory over all three NIST curves verifying metadata and independently validating DER signatures against the GetPublicKey SPKI via ECDsa.VerifyData, plus rejection tests for wrong algorithm, wrong key usage, and encrypt/decrypt on ECC keys.
• All 40 KMS tests pass in Debug and Release; changed files pass dotnet format --verify-no-changes.

Docs page docs/services/kms updated with the new specs and DER signature semantics.

Fixes: #16