feat(stdlib): Add ML-DSA-44/65/87 signature support

[lomigmegard]

Adds the FIPS 204 module-lattice signature algorithms as key and signature algorithms, wires them through the OpenSSL backend and the PKI actions, and adds a post-quantum root CA example.

Ceremony authors get algorithm: ML-DSA-87 on generate_keypair; generate_csr and issue_certificate derive the signature algorithm from the key, so no new DSL surface is introduced.

Implementation notes:

• Key generation goes through EVP_PKEY_fromdata with an explicit 32-byte seed. FIPS 204 expands the whole keypair deterministically from that seed, and it is the only generation route the openssl crate exposes without raw FFI, which the workspace forbids.
• Signing takes the digest-free EVP_DigestSign path: ML-DSA signs the message directly with no pre-hash.
• ML-DSA bindings are gated on OpenSSL 3.5 at build time, so rite-openssl gains a build script that re-derives the ossl350 cfg from the version openssl-sys publishes via its links metadata. Builds against older OpenSSL compile without ML-DSA and report it as an unsupported algorithm. openssl-sys is a dependency with no source reference for this reason, and says so, since removing it as unused would silently drop ML-DSA everywhere.
• CSR self-signature verification delegates ML-DSA to the OpenSSL provider, since the existing RSA and ECDSA branches use RustCrypto and no in-tree verifier covers ML-DSA.

Tests pin the FIPS 204 signature sizes, a seed-to-public-key known answer cross-checked against the OpenSSL CLI, the hedged (non-reproducible) nature of signing, and the certificate OIDs as a wire contract.