crypto: Refactor hash algorithm usage across crate

[smalis-msft]

Refactor the usage of hash algorithms to consolidates hash algorithm definitions and updates their usage throughout the crate. Annoyingly the RustCrypto crates wants hash algorithms at a type level, so I can't quite clean them up as much without resorting to const generics.

[github-actions]

⚠️ Unsafe Code Detected

This PR modifies files containing unsafe Rust code. Extra scrutiny is required during review.

For more on why we check whole files, instead of just diffs, check out the Rustonomicon

[Copilot]

Pull request overview

This PR refactors hash algorithm handling in the support/crypto crate by centralizing hash algorithm definitions/conversions and updating RSA/X.509/PKCS7 code (and downstream OpenHCL callers) to use the new shared type.

Changes:

• Introduce crypto::HashAlgorithm (new hashes module) with backend-specific hashing/conversion helpers and SHA-1 deprecation.
• Update RSA backends (OpenSSL/RustCrypto/SymCrypt) plus X.509/PKCS7 code to use HashAlgorithm conversions and shared hashing helpers.
• Update underhill_attestation to use crypto::HashAlgorithm instead of crypto::rsa::HashAlgorithm, adding targeted #[expect(deprecated)] where SHA-1 is still required.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
support/crypto/src/lib.rs	Adds hashes module and re-exports HashAlgorithm from the crate root.
support/crypto/src/hashes.rs	New centralized HashAlgorithm type, SHA-1 deprecation, hashing helpers, and backend conversions.
support/crypto/src/rsa/mod.rs	Removes RSA-local HashAlgorithm and switches public RSA APIs to use the crate-level type.
support/crypto/src/rsa/ossl.rs	Replaces local digest mapping helpers with HashAlgorithm Into conversions.
support/crypto/src/rsa/rust.rs	Uses centralized HashAlgorithm and shared hashing helper for PKCS#1 sign/verify.
support/crypto/src/rsa/symcrypt.rs	Uses centralized HashAlgorithm hashing/conversion instead of local helpers.
support/crypto/src/x509/symcrypt_rust.rs	Centralizes OID→hash mapping via HashAlgorithm::try_from.
support/crypto/src/pkcs7/symcrypt_rust.rs	Updates signing to use crate::HashAlgorithm::Sha256.
openhcl/underhill_attestation/src/test_helpers.rs	Updates JWT signing helper to use crypto::HashAlgorithm::Sha256.
openhcl/underhill_attestation/src/secure_key_release.rs	Switches to crypto::HashAlgorithm, adds #[expect(deprecated)] for required SHA-1 usage.
openhcl/underhill_attestation/src/key_protector.rs	Updates RSA-OAEP calls to use crypto::HashAlgorithm.
openhcl/underhill_attestation/src/jwt.rs	Updates JWT signature verification/signing to use crypto::HashAlgorithm::Sha256.

[jennagoddard]

[github-actions]

1 Petri tests failed (1 unstable)