remove git dependency on hashes and hmac

[baloo]

No description provided.

[json420]

I don't know enough about the changes in hashes and hmac to saying anything too smart about this PR, but I do know that if I:

cargo add ml-dsa --git https://github.com/baloo/signatures.git --branch baloo/remove-git-dependencies
cargo add slh-dsa --git https://github.com/baloo/signatures.git --branch baloo/remove-git-dependencies
cargo build

Then that works! The same currently does not work from RustCrypto/signatures git master. So this is obvious forward progress for my two very most favorite signatures crates, ml-dsa and slh-dsa, haha 😛

For what it's worth, 👍 from me.