Recipient-aware enveloping + full post-quantum SCEP

[pdb0102]

Makes the SCEP client choose the EnvelopedData recipient correctly from the GetCACert bundle, branch the RecipientInfo by the recipient's algorithm, and surface cert-usage conformance findings — then takes it all the way to post-quantum (signing and key establishment), verified against OpenSSL.

Recipient-aware core

• RecipientSelector: picks signing vs. encryption cert by KeyUsage (RFC 8894 leaves this undefined), with a positional fallback; emits findings (signature-only CA → can't envelope; encryption key missing its KeyUsage bit; keyUsage/position mismatch).
• BcEnvelope branches enveloping by recipient algorithm — RSA KeyTransRecipientInfo, EC ephemeral-ECDH KeyAgreeRecipientInfo, ML-KEM KEMRecipientInfo. Contract (IScepCrypto) unchanged.

Post-quantum (BouncyCastle 2.5.0 → 2.6.1)

• PQ CA signing (ML-DSA, SLH-DSA) of CertRep responses via the SignerInfoGeneratorBuilder path.
• PQ key establishment: hand-rolled RFC 9629 KEMRecipientInfo (HKDF-SHA256 + AES-KeyWrap, CBC + GCM) — decrypted by OpenSSL 3.6.2 in an interop test.
• PQ certificate enrollment: enroll an ML-DSA/SLH-DSA subject key (issued cert carries the PQ key) over a transient RSA transport, because RFC 8894 encrypts the response to the requester's signing key and no PQ algorithm both signs and decapsulates. A pure-PQ-signed request can be emitted as a conformance probe.

Ready-to-use fake server: /scep/ endpoints (rsa, rsa-split, ec-encrypt, ec-dual, ecdsa-rsa, mldsa-rsa, slhdsa-rsa, mlkem-encrypt, mldsa-mlkem, mldsa-only, signing-only) — drive a real SCEP client or scripted tests against any recipient/signing combination.