Gate PKCS #1 v1.5 as opt-in via feature=pkcs1v15 - #778

* Replace `CryptoRng` with `TryCryptoRng` (RustCrypto#779)

Adds baseline support for handling RNG failures as errors.

Fork adaptation: the remaining `CryptoRng` bounds on the fork's generic
encrypting and signing keys move to `TryCryptoRng` as well. The upstream
message's issue reference is dropped.

(cherry picked from commit 9c26587)

* Gate PKCS #1 v1.5 as opt-in via `feature=pkcs1v15` (RustCrypto#778)

Fork adaptation: the gate covers the heapless PKCS#1 v1.5 path as well,
and the feature stays off by default, as upstream. The fork's
consumers that use it enable it: the modmath examples (required
features), the footprint, ct-verify and checkct crates, and the
marvin-toolkit. The modmath backend's PKCS#1 v1.5 tests and the
heapless smoke test are gated on it. Upstream's README hunk goes to
UPSTREAM_README.md; our README notes the opt-in. The test-file
conflicts keep the fork's versions of tests that round 1 left out. The
upstream message's issue reference is dropped.

(cherry picked from commit f551f4c)

* Build docs.rs with --all-features

(cherry picked from commit 942ca23)

* .codecov.yml: initial configuration (RustCrypto#783)

(cherry picked from commit 5937253)

* CI: add codecov coverage job

Ports upstream's coverage job, skipped in the first catch-up round and
recorded as merged by it, now that the fork reports to codecov too.
Coverage runs for `rsa_heapless` with all features. The upload passes
the repository's `CODECOV_TOKEN`, which a fork repository needs and
upstream's job does not set. Locally the job measures 90.9% line
coverage against the 90% project target in `.codecov.yml`.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Tony Arcieri <bascule@gmail.com>
Co-authored-by: pinkforest(she/her) <36498018+pinkforest@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

## Security
- Replace `num-bigint-dig` with `crypto-bigint` for constant-time
  modular exponentiation (#394)
- Redact private-key components from `Debug` output (#480)
- Harden private-key operations following `draft-irtf-cfrg-rsa-guidance`
  (#710, #715, #739, #751, #752, #755, #756, #758, #770,
  #771, #773)
- Zeroize stored secret-prime Montgomery parameters in
`PrecomputedValues` (#716)
- Implement PKCS#1 v1.5 implicit rejection: return deterministic
  synthetic plaintext on invalid padding instead of exposing a padding
  error and with it a sidechannel (#726, #729, #749)

## Added
- PKCS#8/SPKI decoding for PSS keys, including `id-RSASSA-PSS` algorithm
  identifiers (#424)
- `pss::VerifyingKey::salt_len` and opt-in automatic salt-length
  detection via `new_with_auto_salt_len` (#448, #546)
- Wycheproof test coverage for PKCS#1 v1.5, PSS, and OAEP (#477,
  #740)
- `PublicKeyParts::n_bytes` and `e_bytes` serialization helpers (#519)
- Multipart signing trait implementations for PKCS#1 v1.5 and PSS
  (#525)
- `Clone` and `core::error::Error` implementations for `Error` (#530,
  #694)
- `PrivateKey::as_public_key` accessor (#592)
- Algorithm-specific inherent methods on `PrivateKey` and `PublicKey`
  for OAEP encryption/decryption and PKCS#1 v1.5/PSS signing/verification,
  including prehash and explicit-RNG variants (#638)
- `PrivateKey::from_components_with_large_exponent`, gated on `hazmat`
  (#648)
- Constant-time validation harness using `cargo checkct`/BINSEC (#732,
  #733, #749, #756, #771, #773)
- `PrivateKey::from_components_with_wide_primes` for unbalanced
  two-prime keys, which ordinary constructors now reject (#755)
- `TryFrom<BitStringRef<'_>>` for PKCS#1 v1.5 and PSS signatures
  (#764)
- `crypto_common::Generate` implementation and `Generate` re-export for
  generating 3072-bit keys with public exponent 65537 (#780)

## Changed
- Replace `BigUint` in the public API with `BoxedUint`; return
  `NonZero<BoxedUint>` for the modulus and `Odd<BoxedUint>` for prime
  factors (#394, #735)
- Use `crypto-primes` for prime generation (#394)
- Use DER-based key encodings and hex-or-binary serde representations
  via `serdect`; extend serde support to OAEP, PKCS#1 v1.5, and PSS
  wrapper types (#420)
- Accept arbitrary byte strings as OAEP labels (#467)
- Gate PKCS#1/PKCS#8/SPKI support on the default-enabled `encoding`
  feature; `std` no longer implicitly enables encoding dependencies
  (#537, #543)
- Enforce a 1024-bit minimum for key generation and default public-key
  construction/decoding; add `PublicKey::new_with_size_limits` and
  `hazmat`-gated unchecked key generation (#576, #760)
- Bump `pkcs1` to v0.8; `pkcs8` to v0.11; `spki` to v0.8; `serdect` to
  v0.4 (#584, #684, #688, #766)
- Make `Oaep` and `Pss` generic over their digest types instead of using
  `DynDigest` (#593)
- Bump `rand_core` to v0.10, `crypto-common` to v0.2, `digest` to v0.11,
  and `signature` to v3 (#650, #671, #693)
- Remove a redundant allocation during OAEP decryption (#659)
- Improve encryption and verification performance by bounding
  exponentiation to the public exponent's bit length (#662)
- Bump `crypto-bigint` to v0.7.10 and `crypto-primes` to v0.7 (#673,
  #766)
- Raise the default maximum public-key modulus size to 8192 bits
  (#681)
- Bump `sha1` and `sha2` to v0.11 (#683)
- Store PKCS#1 v1.5 and PSS signatures as byte strings, preserving their
  encoded width (#722, #723)
- MSRV 1.87; Rust 2024 edition (#731, #757)
- Enable `getrandom` by default and use the system RNG for blinding in
  default decryption and signing paths (#739, #758)
- Limit signature decoding to 1024 bytes by default; add
  `Signature::from_bytes_with_max_len` for explicit limits (#767)
- Require the opt-in `pkcs1v15` feature for PKCS#1 v1.5 encryption and
  signatures (#778)
- Accept fallible RNGs through `TryCryptoRng` and propagate RNG failures
  as errors (#779)
- Rename `RsaPrivateKey` and `RsaPublicKey` to `PrivateKey` and
  `PublicKey`, retaining the old names as deprecated aliases (#781)

## Deprecated
- `pss::BlindedSigningKey` in favor of `pss::SigningKey`, which now
  applies blinding by default (#758)
- `PublicKey::new_with_max_size` in favor of
  `PublicKey::new_with_size_limits` (#760)

## Removed
- `nightly` and `u64_digit` features associated with `num-bigint-dig`
  (#394)
- Deprecated `Pkcs1v15Sign::new_raw` and `pkcs1v15` `*_with_prefix`
  constructors (#524)
- Separate `pem` feature; PEM support is included with `encoding`
  (#537)
- Optional `sha2` feature; SHA-2 support is now always enabled (#749)

## Fixed
- Honor explicit larger-key construction limits during cryptographic
  operations, including OAEP decryption (#441, #595)
- PKCS#1 v1.5 `SigningKey::from` and `VerifyingKey::from` now use the
  digest prefix consistent with `new` (#472, #498)
- Check the modulus's actual bit length instead of its storage precision
  when enforcing size limits (#529)
- Retry zero blinding factors instead of replacing them with one
  (#653)
- Reject private-key factors less than or equal to one, even or repeated
  factors, and private exponents greater than or equal to the modulus
  (#655, #738, #772, #774)
- Reject PSS salt lengths that cannot be represented by the
  `AlgorithmIdentifier` encoder instead of truncating them (#704)
- Apply RFC 8017 encoded-message width rules for PSS, including moduli
  whose bit length is congruent to 1 modulo 8 (#725)
- Return verification errors instead of panicking for undersized PSS
  encoded messages and overflowing salt lengths (#769)
- Propagate CRT precomputation errors from private-key constructors
  (#782)

Fixes #865.

- Require `rsa` 0.10.0 with the `pkcs1v15` feature, where `Pkcs1v15Sign` now
  lives (RustCrypto/RSA#778).
- Replace the deprecated `rsa::RsaPublicKey` alias with `rsa::PublicKey`.
- Keep accepting RSA keys shorter than 1024 bits. `rsa` 0.10.0 rejects them
  when decoding, so keys are now decoded with `rsa::pkcs1` and built with
  `PublicKey::new_with_size_limits`, as the `rsa` docs suggest. The rest of
  `rsa`'s validation is unchanged, including the algorithm-identifier checks
  for `SubjectPublicKeyInfo` keys.