Bring up Windows HKDF with CNG

[vcsjones]

This implements HKDF on top of Windows CNG for DeriveKey and Expand.

Windows support is a little limited. Particularly:

1. Extract is not clearly defined on how to accomplish this, so Extract remains implemented by managed code.
2. CNG will not permit HKDF with MD5. When MD5 is specified, we fall back to managed.
3. Requires Windows 10 1803 or later.

[Copilot]

Pull Request Overview

This PR implements HKDF (HMAC-based Key Derivation Function) support on Windows using the CNG (Cryptography Next Generation) API, providing a native Windows implementation for better performance. The implementation includes fallbacks to managed code for unsupported scenarios and algorithms.

• Adds native Windows CNG implementation for HKDF DeriveKey and Expand operations
• Maintains managed code fallback for Extract operation and MD5 hash algorithm
• Requires Windows 10 version 1803 or later for CNG support

Reviewed Changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
System/Security/Cryptography/HKDF.Windows.cs	New Windows-specific HKDF implementation using CNG APIs with fallback logic
System.Security.Cryptography.csproj	Updated project file to include Windows HKDF implementation instead of managed-only version
Interop.Blobs.cs	Added KDF_HKDF_INFO buffer descriptor constant for HKDF info parameter
Interop.BCryptAlgPseudoHandle.cs	Added BCRYPT_HKDF_ALG_HANDLE pseudo-handle for HKDF algorithm
Cng.cs	Added HKDF algorithm name constant and reordered RSA constant

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-security, @bartonjs, @vcsjones
See info in area-owners.md if you want to be subscribed.