feat: implement LMS/XMSS stateful hash signatures (SP 800-208)

[mcemkoca]

Context

Per Ahmed et al. 2025 survey, stateful hash-based signatures (LMS / XMSS per NIST SP 800-208) are already supported in MbedTLS and wolfSSL and are critical for firmware signing use cases.

QSCG currently has SLH-DSA (stateless, FIPS 205) but lacks LMS/XMSS (stateful). Many embedded/IoT deployments prefer LMS/XMSS for firmware signing because they are smaller and faster than SLH-DSA.

References

• NIST SP 800-208: Recommendation for Stateful Hash-Based Signature Schemes
• RFC 8554: Leighton-Micali Hash-Based Signatures (LMS)
• RFC 8391: XMSS: eXtended Merkle Signature Scheme
• Section 5.3 (MbedTLS) and 5.6 (wolfSSL) in the survey

Acceptance Criteria

• LMS (HSS) key generation, signing, verification for parameters 5/1, 5/3, 5/5
• XMSS^MT key generation, signing, verification for XMSS-SHA2_10_256
• Stateful key management (index tracking, backup, rollback protection)
• Test vectors from NIST CAVP
• Benchmark comparison vs SLH-DSA

Priority

High — CNSA 2.0 and firmware signing requirements