Tang Hybrid PQC Recovery implementation

[sarroutbi]

For PQC to work appropriately, library requires usage of updated JOSE library. Changes (unmerged) available at:
latchset/jose#184
In case specific JOSE functions and algorithms are not available, Tang will work as previously, not including the files that are PQC specific

Add hybrid post-quantum cryptography (ML-KEM-768) support to Tang via a bidirectional KEM envelope protocol, maintaining full backward compatibility with existing Clevis clients.

Tang generates an ML-KEM-768 keypair alongside its existing EC keys. Two new endpoints handle the PQC key lifecycle:

GET /adv-kem — Serves a signed JWS containing only KEM (kty=AKP) keys, separate from /adv so legacy Clevis clients never encounter key types they can't handle.
POST /rec-kem/:thp — Bidirectional KEM recovery endpoint implementing a forward+return channel envelope:
a. Client encapsulates to Tang's KEM public key (forward channel), encrypts an inner payload under that shared secret
b. Tang decapsulates, verifies ek_digest (SHA-256 thumbprint of the enc_key) to prevent oracle attacks, then encapsulates back to the client's ephemeral KEM public key (return channel)
c. Tang encrypts enc_key under the return-channel shared secret and returns it — enc_key never appears in plaintext in the response

Architecture

PQC code is cleanly isolated from the core server:

• src/pqc.c / src/pqc.h — All KEM handlers (adv_kem, rec_kem), JWE compact serialization, secure memory zeroing. Only compiled when jose supports the KEM API.
• src/pqc_noop.c — Stub implementations (404 responses) compiled when jose lacks KEM support.
• No #ifdef in core files — keys.h, keys.c, and tangd.c have zero PQC conditional compilation. A meson compiler.links() probe detects jose KEM API support at build time, and src/meson.build selects pqc.c or pqc_noop.c accordingly.

Other changes

GET /version — New endpoint reporting server capabilities (tang_pub, hybrid_recovery) and version.
tangd-keygen — Generates ML-KEM-768 keys when jose supports it (soft-fails otherwise).

Test coverage

• /adv-kem tests: verifies only AKP keys are returned, JWS is signed by the signing key, /adv excludes AKP keys
• /rec-kem tests: full 10-step bidirectional envelope round-trip, plus error cases (bad JSON, wrong key type, non-existent thumbprint, invalid ek_digest)
• Unit tests: AKP key filtering into m_kem_payload, m_has_pqc detection, jwk_sign edge cases, cleanup NULL safety
• All tests gracefully skip on jose without ML-KEM support

[codecov]

Codecov Report

❌ Patch coverage is 61.01695% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 62.56%. Comparing base (83de399) to head (a66b75a).
⚠️ Report is 5 commits behind head on master.

Files with missing lines	Patch %	Lines
src/tangd.c	68.75%	4 Missing and 6 partials ⚠️
src/keys.c	66.66%	2 Missing and 5 partials ⚠️
src/pqc_noop.c	0.00%	6 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #165      +/-   ##
==========================================
+ Coverage   58.44%   62.56%   +4.11%     
==========================================
  Files           4        5       +1     
  Lines         580      625      +45     
  Branches      147      156       +9     
==========================================
+ Hits          339      391      +52     
+ Misses        140      129      -11     
- Partials      101      105       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.