feat: Add configurable CBC-HMAC support with backward compatibility

[karen-avetisyan-mc]

eat: Add configurable CBC-HMAC support for JWE encryption

Add support for HMAC authentication in CBC mode encryption algorithms
(A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) with backward compatibility.

Features:

• Implement RFC 7516 compliant HMAC verification for CBC-HMAC algorithms
• Add EnableCbcHmacVerification configuration flag (default: false)
• Support all three CBC-HMAC variants with proper key splitting
• Constant-time HMAC comparison to prevent timing attacks
• Proper HMAC tag truncation per RFC specification

Configuration:

• Add WithCbcHmacVerification() method to JweConfigBuilder
• HMAC verification disabled by default for backward compatibility
• Users can opt-in to enable authenticated encryption

Implementation:

• Update AesCbc class with conditional HMAC generation and verification
• Split CEK into HMAC key (first half) and AES key (second half)
• Compute HMAC over: AAD || IV || Ciphertext || AAD_Length
• Select HMAC algorithm (SHA-256/384/512) based on key length
• Pass configuration flag through JweObject to AesCbc methods

Testing:

• Add 14 comprehensive unit tests covering all scenarios
• Test backward compatibility with HMAC disabled
• Test encryption/decryption for all CBC-HMAC algorithms
• Test security features (tampering detection)
• Test configuration builder methods
• All 186 tests pass (172 existing + 14 new)

Documentation:

• Update README with supported algorithms section
• Document CBC-HMAC verification configuration
• Add security recommendations
• Include code examples for enabling HMAC

Breaking Changes: None

• HMAC verification is disabled by default
• Full backward compatibility maintained

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud