Fix: Replace IllegalArgumentException with GeneralSecurityException in HpkePrimitiveFactory

[LuisCastellanos-dev]

Problem

HpkePrimitiveFactory.createKem(), createKdf(), and createAead() throw
IllegalArgumentException when an unrecognized algorithm identifier is passed.
This is inconsistent with the rest of Tink's internal API, which uses
GeneralSecurityException as the standard exception type for cryptographic failures.

Callers that wrap these methods inside catch (GeneralSecurityException e) —
the idiomatic Tink pattern — will not catch the failure. The exception propagates
as an unchecked RuntimeException, bypassing any recovery logic.

Additionally, createKdf(byte[]) and createKdf(KdfId) did not declare
throws GeneralSecurityException, making the inconsistency visible in the signature.

Changes

HpkePrimitiveFactory.java:

• Changed all 6 throw new IllegalArgumentException(...) to GeneralSecurityException
• Added throws GeneralSecurityException to both createKdf overloads

HpkePrimitiveFactoryTest.java:

• Updated 3 error-path tests to expect GeneralSecurityException
• Added import java.security.GeneralSecurityException

Impact

Source-compatible for callers already catching GeneralSecurityException.
The createKdf() signature change adds a checked exception where none existed before.