fix(hkdf): validate output length before allocation

[harrshita123]

Summary

• validate the RFC 5869 HKDF output limit before allocating the native output buffer
• preserve BoringSSL's output-too-large handling as a defensive fallback
• cover the exact limit and the first invalid length for every supported hash
• verify that a very large length is rejected without reaching native allocation

Root cause

The FFI implementation allocated length ~/ 8 bytes before calling BoringSSL. BoringSSL enforces HKDF's 255 * HashLen maximum, but an extremely large request could fail during allocation before reaching that validation.

The implementation now derives the maximum from EVP_MD_size and rejects oversized output lengths before entering the allocation scope.

Validation

• dart format --output none --set-exit-if-changed lib/src/impl_ffi/impl_ffi.hkdf.dart test/hkdf_output_length_test.dart
• dart analyze --fatal-warnings .
• dart test test/hkdf_output_length_test.dart
• dart test -p vm --exclude-tags browser-interop

Fixes #349