rust-rustls: verify ML-DSA signatures (RFC 9881)

Enable rustls-webpki's aws-lc-rs-unstable feature so the ML-DSA-44,
ML-DSA-65 and ML-DSA-87 verification algorithms join
ALL_VERIFICATION_ALGS, matching the ML-DSA coverage recently added to
the rustls/webpki x509_limbo test harness.

The rfc9881::ml-dsa-44/65/87 testcases now validate successfully and
ml-dsa-44-bad-signature fails signature verification as expected. The
ml-dsa-44-key-encipherment and ml-dsa-44-key-agreement testcases
succeed against an expected FAILURE, matching the known divergence
recorded in rustls/webpki's exceptions (webpki does not enforce the
RFC 9881 key usage restrictions).

Author: cpu

harness/rust-rustls/Cargo.toml

@@ -7,5 +7,9 @@ edition = "2021"
 limbo-harness-support = { path = "../../harness-support/rust" }
 chrono = "0.4.44"
 serde_json = "1.0.150"
-rustls-webpki = { version = "0.103.13", features = ["std", "aws-lc-rs"] }
+rustls-webpki = { version = "0.103.13", features = [
+    "std",
+    "aws-lc-rs",
+    "aws-lc-rs-unstable",
+] }
 pki-types = { package = "rustls-pki-types", version = "1.14.1" }