feat: add GnuTLS ML-DSA (FIPS 204 / RFC 9964) backend

Implement the GnuTLS side of ML-DSA, deferred from #227. GnuTLS does ML-DSA
when built against a PQC provider (e.g. --with-leancrypto); it is enabled when
GnuTLS >= 3.8.10 is present and WITH_ML_DSA is set.

GnuTLS has no raw ML-DSA import, so gnutls_process_mldsa() builds the encoded
key from the JWK's raw "pub" / 32-byte "priv" seed (a SubjectPublicKeyInfo for
public keys, a seed-form PKCS#8 for private keys) and imports that. Signing
uses gnutls_privkey_sign_data2() / gnutls_pubkey_verify_data2() with
GNUTLS_SIGN_MLDSA44/65/87; the sign path pins the expected GNUTLS_PK_MLDSA*
so a mismatched-variant key is rejected. Native-key -> JWK export recovers the
raw public key from the SPKI and the 32-byte seed from a seed-form PKCS#8.

- A seedless (expanded-only) private key has no FIPS-204 seed and cannot be a
  private AKP JWK. GnuTLS's seed PKCS#8 export null-derefs on such a key, so
  export probes for the seed via a plain PKCS#8 export first and downgrades to
  a public export when absent (matching the OpenSSL backend) instead of
  crashing.
- The private seed is wiped from its stack buffer after import.

LIBJWT_HAVE_ML_DSA is now defined for OpenSSL >= 3.5 OR GnuTLS >= 3.8.10, and
each backend's ML-DSA code carries its own version guard so a build can enable
the feature via either backend independently. MbedTLS still has no ML-DSA and
rejects AKP keys via the common null-guard.

The ML-DSA tests gain a runtime capability probe so the sign/verify/export and
seedless-downgrade tests run on every ML-DSA-capable backend (OpenSSL and a
PQC-enabled GnuTLS) and skip the rest. README and the public header note the
GnuTLS path.

closes #301

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Ben Collins <bcollins@libjwt.io>