feat: add experimental ML-DSA (FIPS 204 / RFC 9964) signing

Add support for the post-quantum ML-DSA signature algorithms (ML-DSA-44,
ML-DSA-65, ML-DSA-87) registered for JOSE by RFC 9964. ML-DSA keys use the
new "AKP" (Algorithm Key Pair) JWK key type with a "pub" member and a "priv"
member holding the 32-byte FIPS-204 seed; "alg" is required on every AKP key.

The feature is experimental and off by default: build with -DWITH_ML_DSA=ON.
It is only enabled when a backend that implements ML-DSA is present (OpenSSL
>= 3.5 today), and the public header then defines LIBJWT_HAVE_ML_DSA so
downstream code can detect it. The JWT_ALG_ML_DSA_* and JWK_KEY_TYPE_AKP enum
values are always present (ABI), but all behavior is gated on the macro.

- OpenSSL: real sign/verify (one-shot, like EdDSA), AKP JWK parse via the
  seed, and native-key -> JWK export. A seedless private key (one with no
  retained FIPS-204 seed) downgrades to a clean public export rather than a
  private JWK with no private material.
- GnuTLS / MbedTLS: cleanly reject AKP keys at parse time via a null-guard on
  jwt_ops->process_mldsa (a real GnuTLS implementation is tracked in #301).
- Anti algorithm-confusion: ML-DSA maps to JWK_KEY_TYPE_AKP only, and the
  variant is pinned to the key, so a 44 key cannot be used for an 87 token.

Tests cover sign/verify and the emitted header alg for all three variants,
AKP parse-error branches, the non-OpenSSL reject path, native PEM/DER -> JWK
export (including the seedless downgrade), public-export priv-stripping, and
the CLI tools, under both Jansson and json-c.

closes #227

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Ben Collins <bcollins@libjwt.io>