feat(kms): add post-quantum signing example using ML-DSA-87

[a-custodio]

This PR adds a comprehensive sample demonstrating Post-Quantum Cryptography (PQC) for digital signatures. It implements the ML-DSA-87 algorithm using Google Cloud KMS and provides a complete workflow for infrastructure provisioning, signing, and verification.

Implementation Details

• Infrastructure: Provisions a KMS KeyRing and CryptoKey with ALGORITHM_ML_DSA_87 via Terraform.
• Verification Logic: Implements a robust verification mechanism that handles the OpenSSL 3.5+ dependency by leveraging a sidecar Docker container (alpine:latest). This ensures cross-platform compatibility for NIST-standardized PQC algorithms.
• Scripts:
  • sign.sh: Wraps gcloud kms asymmetric-sign.
  • verify.sh: Exports public key and performs verification via OpenSSL 3.5.

Test Plan

• Integration Tests: A new test suite has been added to test/integration/pqr-kms-signing/ using blueprint-test.
• Manual Verification:
  • Successfully deployed via terraform apply.
  • Verified signing and validation on Linux/macOS.
  • Confirmed that tampered files correctly fail verification.

Test Logs:

1 --- PASS: TestPQRSigningModule (145.23s)
2 pqr_kms_signing_test.go:78: Signature is VALID!
3 pqr_kms_signing_test.go:85: Verify script should fail on tampered content
4 PASS
5 ok pqr_kms_signing 145.23s