Add HPKE (RFC 9180) hybrid public key encryption

[Xor-el]

Implement the Hybrid Public Key Encryption facade supporting all four authentication modes (base, psk, auth, auth_psk), each combinable with any of the four AEADs: AES-128-GCM, AES-256-GCM, ChaCha20-Poly1305, and the export-only suite (secret export with no seal/open). Key encapsulation covers the five DHKEM suites (P-256, P-384, P-521, X25519, X448) over the three HKDF variants (SHA-256/384/512).

• New Crypto/Hpke units: THpke facade, TDhKem, THpkeKdf, THpkeAead, THpkeContext (+ interfaces), reusing the existing raw ECDH/X25519/X448 agreements, GCM/ChaCha20-Poly1305 AEADs and HKDF generator.
• Expose ExtractPRK on THkdfBytesGenerator so the labeled KDF composes over the existing extract path instead of duplicating it.
• Zeroize derived key material: the AEAD wipes its key and base nonce, the context wipes the exporter secret, and the key schedule and DHKEM wipe the DH output, PRKs, master secret and derived scalar buffers after use.
• Seal/open expose whole-buffer and offset/length overloads (the former delegating to the latter); a post-doFinal output-size mismatch fails closed before the sequence number advances.
• Tests: HpkeVectors loader plus HpkeTests covering all 128 published vectors (every mode x KEM x KDF x AEAD), the intermediate KEM shared secret, pairwise base/auth/export-only round-trips, the offset overloads, and the negative cases (tampered tag, wrong sender key, sequence number not advanced on failure).