kms/mackms: add user-authorization policy for Secure Enclave keys

[joshdrake]

Summary

Adds per-key user-authorization (Touch ID / biometric / passcode) to mackms via two new URI parameters plus a prompt-text override:

• policy=user-presence — kSecAccessControlUserPresence (Touch ID, Apple Watch, or device passcode)
• policy=user-verification — kSecAccessControlBiometryCurrentSet (Touch ID only; key invalidates on enrollment change)
• cache=<duration> — LAContext.touchIDAuthenticationAllowableReuseDuration, clamped to 300s
• reason=<text> — localizedReason shown in the macOS prompt

A new LAContext wrapper in internal/darwin/security bridges the LocalAuthentication framework via a small Objective-C shim, and is plumbed into getPrivateKey via kSecUseAuthenticationContext so the prompt fires before SecKeyCreateSignature.

Authorization policies require se=true; software keys can't enforce the policy at the hardware level, so we reject the combination at CreateKey rather than silently downgrading. The legacy bio=true flag is preserved as an alias for policy=user-verification.

Part of the User-Authorized Signing for Hardware-Bound Keys RFC — macOS piece. Cross-platform support (Windows/Linux) is out of scope for this PR.

Note on base

This branch is currently based on v0.78.0 to stay compatible with the agent's current dependency pin. Rebasing onto master is straightforward; happy to do that as the consuming PR lands.

Test plan

• go test ./kms/mackms/... on macOS (CI)
• Manual: create an SE key with policy=user-presence, sign, confirm Touch ID prompt appears with configured reason
• Manual: with cache=60s, confirm re-sign within 60s skips the prompt
• Manual: cancel prompt → sign call returns error
• Manual: policy=user-verification rejects passcode (biometric-only)

🤖 Generated with Claude Code

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}