Add PKCS#11-based PDF signing infrastructure

Introduced a cryptographic infrastructure for PDF signing and validation using PKCS#11-based hardware security modules (HSMs) or software tokens. Key changes include:

- Added `PdfDigitalSignatureService` for signing PDFs, multi-signature support, and signature validation.
- Implemented `Pkcs11ExternalSigner` and `Pkcs11PdfSigningRsa` for PKCS#11-based signing with DevExpress PDF infrastructure.
- Added utilities like `Pkcs11SessionRunner`, `Pkcs11InteropBootstrap`, and `Pkcs11ToolBridge` for session management, library initialization, and fallback mechanisms.
- Introduced `Pkcs11Options` for managing PKCS#11 configurations.
- Updated project dependencies to include `DevExpress.Document.Processor`, `System.Security.Cryptography.Pkcs`, and `Pkcs11Interop`.
- Enhanced error handling and fallback support for PKCS#11 operations.

These changes enable robust and extensible PDF signing capabilities with detailed signature metadata extraction and validation.

EnvelopeGenerator.Infrastructure.Crypt/Services/Pkcs11ExternalSigner.cs

@@ -0,0 +1,49 @@
+using EnvelopeGenerator.Application.Common.Configurations;
+using DevExpress.Office.DigitalSignatures;
+using DevExpress.Pdf;
+
+namespace EnvelopeGenerator.Infrastructure.Crypt.Services;
+
+internal sealed class Pkcs11ExternalSigner(Pkcs11Options options) : Pkcs7SignerBase
+{
+    private readonly Pkcs11PdfSigningRsa rsa = new(options);
+    private readonly DigestCalculator digestCalculator = new(HashAlgorithmType.SHA256);
+    private readonly IReadOnlyList<byte[]> certificates = [ReadCertificateBytesWithFallback(options)];
+
+    protected override IDigestCalculator DigestCalculator => digestCalculator;
+
+    protected override string SigningAlgorithmOID => "1.2.840.113549.1.1.1";
+
+    protected override IEnumerable<byte[]> GetCertificates() => certificates;
+
+    protected override byte[] SignDigest(byte[] digest)
+    {
+        return rsa.SignHash(digest, System.Security.Cryptography.HashAlgorithmName.SHA256, System.Security.Cryptography.RSASignaturePadding.Pkcs1);
+    }
+
+    private static byte[] ReadCertificateBytesWithFallback(Pkcs11Options options)
+    {
+        try
+        {
+            return Pkcs11SessionRunner.Run(options, session =>
+            {
+                var attrs = new List<Net.Pkcs11Interop.HighLevelAPI.IObjectAttribute>
+                {
+                    session.Factories.ObjectAttributeFactory.Create(Net.Pkcs11Interop.Common.CKA.CKA_CLASS, Net.Pkcs11Interop.Common.CKO.CKO_CERTIFICATE),
+                    session.Factories.ObjectAttributeFactory.Create(Net.Pkcs11Interop.Common.CKA.CKA_LABEL, options.CertificateLabel)
+                };
+
+                var handles = session.FindAllObjects(attrs);
+                if (handles.Count == 0)
+                    throw new InvalidOperationException($"Certificate '{options.CertificateLabel}' not found in token.");
+
+                var values = session.GetAttributeValue(handles[0], new List<Net.Pkcs11Interop.Common.CKA> { Net.Pkcs11Interop.Common.CKA.CKA_VALUE });
+                return values[0].GetValueAsByteArray();
+            });
+        }
+        catch when (Pkcs11ToolBridge.IsAvailable(options))
+        {
+            return Pkcs11ToolBridge.ReadCertificateBytes(options);
+        }
+    }
+}