fix(crypto): implement ephemeral key zeroization wrappers (#640)

[TheFaith-Code]

Crypto-Isolation | Ephemeral Key Zeroization Wrappers for Transaction Signers

Description

This PR addresses critical vulnerability #640, where secret keys used during automated signing operations could persist in Python heap objects until garbage collection runs.

Technical Details

1. Explicit ctypes.memset In-Place Memory Overwrite:
   • Fixed _wipe_bytes_view in src/crypto/signer.py and src/crypto/engine.py to directly zero out the CPython bytes object buffer in-place using ctypes.memset at the underlying C-struct data offset (id(view) + offset), rather than making a throwaway copy via from_buffer_copy.
2. Enhanced Attribute Inspection & Zeroization (_wipe_key_handle):
   • Expanded _wipe_key_handle to recursively traverse and zeroize internal key attributes (such as _seed, _signing_key, _key, secret_key, _secret_key, _raw_secret_key, raw_secret_key, _keypair, _private_key, private_key, _sk, sk, _vk, vk) across stellar_sdk.Keypair, nacl.signing.SigningKey, and custom key handles.
3. Guaranteed Execution Scope Isolation & Memory Unlock:
   • Enforced immediate finally zeroization wipes in context managers (SecureKeyHandle, SecureSessionCredentials, SecureVariableWrapper, _SecureKeypairContext) and signing entry points (sign, _sign_internal, _try_stellar_sdk, _try_pynacl).
   • Fixed _do_wipe() in SecureKeyHandle to properly invoke _munlock_buffer and reset _locked = False upon memory cleanup.

Verification Test Results

Executed pytest tests/test_signer.py and pytest test/test_signer.py:

closes #640

[drips-wave]

@TheFaith-Code Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits