crypto: AI generated audit feedback

[smalis-msft]

Some small cleanups:

• Rename kbkdf 'salt' to 'label' to match the algorithm's official definition
• Add some comments
• Set xts_aes_256's tweak size to u64 everywhere to match the bcrypt restriction, so we don't accidentally depend on a larger tweak in the future

[github-actions]

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

[Copilot]

Pull request overview

This PR tightens and clarifies parts of the support/crypto APIs and their consumers by aligning parameter naming with the SP800-108 KBKDF spec and standardizing XTS-AES-256 tweak handling to a 64-bit tweak across all backends (matching Windows BCrypt constraints).

Changes:

• Rename KBKDF HMAC-SHA256 parameter from salt to label across backends and the public wrapper.
• Restrict XTS-AES-256 cipher tweak type to u64 in the public API and backend implementations; update disk encryption call sites accordingly.
• Add clarifying documentation/comments (notably around X509Certificate::issued semantics and RSA error TODOs).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
vm/devices/storage/disk_crypt/src/lib.rs	Updates XTS cipher calls to pass u64 tweaks directly (no .into() conversion).
support/crypto/src/xts_aes_256/win.rs	Changes BCrypt XTS tweak parameter type to u64 and simplifies IV construction.
support/crypto/src/xts_aes_256/ossl.rs	Changes OpenSSL XTS tweak parameter type to u64 and zero-extends to 128-bit IV bytes.
support/crypto/src/xts_aes_256/mod.rs	Updates the public XTS cipher API to u64 tweaks and adjusts tests/comments accordingly.
support/crypto/src/x509/mod.rs	Documents that issued() is structural-only and does not verify signatures (points to verify()).
support/crypto/src/rsa/mod.rs	Adds TODO notes about making RSA errors Clone once upstream supports it.
support/crypto/src/kbkdf/symcrypt.rs	Renames KBKDF parameter salt → label to match SP800-108 terminology.
support/crypto/src/kbkdf/ossl.rs	Renames KBKDF parameter salt → label in the OpenSSL-based implementation.
support/crypto/src/kbkdf/mod.rs	Renames KBKDF public API parameter salt → label and forwards accordingly.