Refactor authentication handling

[keldonin]

This PR should hopefully address #201 and #353.

The main idea is to support different methods of authentication around a new type, Credential, which is essentially an enum. From implementations are provided for transparent conversion from AuthPin and RawAuthPin, minimizing code change.

Note: init_token(), set_pin() and init_pin() signatures have changed, making this PR a breaking change.

The changes introduced are:

• refactor API to a new `Credential enum
• integrated with current AuthPin and RawAuthPin
• support for authenticated path on all PIN-related functions (PR Compatibility issues with Luna HSM #201)
• support for PKCS#11 v3.0 C_LoginUser
• using SecretSlice<u8> for RawAuthPin type alias (PR AuthPin forces conversions that can leak secret #353)
• deprecate login_with_raw() as it is now unified under login()

[Copilot]

Pull request overview

This PR refactors authentication handling around a new Credential<'a> type to support multiple PIN forms (UTF-8, raw bytes, protected authentication path) and PKCS#11 v3.0 C_LoginUser, while changing several public APIs (init_token, init_pin, set_pin, login) to use this new abstraction.

Changes:

• Introduces Credential<'a> and helper constructors/From impls to encapsulate UTF-8 pins, raw pins, protected authentication path, and optional usernames, plus corresponding unit tests.
• Refactors Session::login, Session::init_pin, Session::set_pin, Session::login_with_raw, and Pkcs11::init_token to consume Credential (via Into<Credential<'a>>), enabling protected authentication paths and C_LoginUser while rejecting usernames where not allowed.
• Adds Error::UsernameNotExpected for clearer error reporting when a username is provided in contexts that do not support it, and updates docs/examples accordingly.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
cryptoki/src/types.rs	Adds Credential<'a> enum and helpers, switches RawAuthPin to a new secret type (currently mis-specified), and adds unit tests for various Credential forms.
cryptoki/src/session/slot_token_management.rs	Refactors Session::init_pin and Session::set_pin to accept generic credentials, support protected auth path and raw pins, and reject usernames in these contexts.
cryptoki/src/session/session_management.rs	Refactors Session::login to accept generic Credential (including protected auth path and username variants) and to use C_LoginUser when a username is present; deprecates login_with_raw in favor of the unified API.
cryptoki/src/error/mod.rs	Adds Error::UsernameNotExpected and wires it into Display/Error for clearer diagnostics when usernames are passed where unsupported.
cryptoki/src/context/slot_token_management.rs	Changes Pkcs11::init_token to accept generic credentials (including protected auth path) and to reject credentials carrying a username, aligning SO token initialization with the new auth model.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.