refactor(rust_crypto): move RSA backend to rsa 0.10.0-rc.17

[EffortlessSteven]

Addresses #495.

I kept this to the rust_crypto RSA seam.

Scope

• rust_crypto backend only
• no public API changes
• no aws_lc_rs changes
• no crate-wide signature 3 migration
• no crate-wide sha2 0.11 migration

Dependency note

• This uses the currently published crates.io 0.10 line for RSA, which is rsa 0.10.0-rc.17.

Review map

• Cargo.toml
• src/crypto/rust_crypto/rsa.rs
• src/crypto/rust_crypto/ecdsa.rs
• src/crypto/rust_crypto/mod.rs

What changed

• replace wrapper-based RSA signing with explicit prehash + low-level key operations
• keep verification on RsaPublicKey::verify(...)
• move RSA modulus/exponent handling to BoxedUint
• decouple ECDSA from rsa::pkcs8
• preserve minimal big-endian n/e extraction for DecodingKey::from_rsa_components and JWK generation
• add a wasm-target-only getrandom 0.4 alias so the existing wasm-pack commands keep working

Existing coverage already exercising the touched paths

• PEM PKCS#1 and PKCS#8 RSA round-trips
• DER round-trips
• modulus/exponent decode via DecodingKey::from_rsa_components
• JWK decode
• JWK generation from an encoding key

Validated locally

• cargo fmt --check
• cargo clippy --all-targets --features rust_crypto -- -D warnings
• cargo clippy --all-targets --features aws_lc_rs -- -D warnings
• cargo test --features rust_crypto
• cargo test --no-default-features --features rust_crypto
• cargo test --features aws_lc_rs
• cargo test --no-default-features --features aws_lc_rs
• wasm-pack test --node --features rust_crypto,getrandom/js
• wasm-pack test --node --no-default-features --features rust_crypto,getrandom/js

Non-goal

• this does not claim to fully resolve Marvin / RUSTSEC-2023-0071

[arckoor]

Let's not depend on a rc version
Once rsa 0.10 releases, cargo should be free to pull in that version, despite us specifying a lower version in the crate (since they seem to be following semver, 0.10 is a patch release, and cargo is free to resolve it. If it has relevant breaking changes, we'll resolve them then)

[EffortlessSteven]

Absolutely. Leaving the RC alone makes sense.

This shook out the rust_crypto-side changes ahead of stable 0.10 and surfaced the wasm/getrandom wrinkle.

Happy to revisit once 0.10.0 is out.

[baloo]

I'd recommend the use of BoxedUint::from_be_slice_vartime:

Suggested change

	RsaPublicKey::new(to_boxed_uint(n)?, to_boxed_uint(e)?)
	RsaPublicKey::new(BoxedUint::from_be_slice_vartime(bytes), BoxedUint::from_be_slice_vartime(bytes))

NOTE(security): Now this is a variable time function (and inherently dangerous), but here this is only used on a public key and no secret is involved.

[baloo]

Change looks good, but I think I would recommend to bump the other members of rustcrypto (hmac, p256, p384, ...) as this would make the dependency cleaner.
This will otherwise duplicate for the array implementation and all the crypto-common and signature traits (this is what your issues with pkcs8 stemmed from).

[baloo]

BoxedUint::to_be_bytes_trimmed_vartime is the function you're looking for.

NOTE(security): variable timed function, only to be used on public components.