feat: Digital signatures (ISO 32000-2 §12.8) (Block H)

[ralflang]

Digital Signatures

• Part of Project: New-Style PDF library feature parity with legacy and path towards full ISO 32000-2 support #6
• Depends on feat: AcroForm / interactive forms (ISO 32000-2 §12.7) (Block G) #33 (AcroForm), feat(pdf): Advanced PDF Features & PDF Reader (Block E) #15 (PdfReader for incremental update)

Implement PDF digital signature support (PKCS#7/CMS detached signatures).

Signature field: a widget annotation with /FT /Sig and /V pointing to a signature dictionary.

Signature dictionary: /Type /Sig, /Filter /Adobe.PPKLite, /SubFilter /adbe.pkcs7.detached, /ByteRange, /Contents.

Signing workflow:

1. Serialize PDF with placeholder /Contents and /ByteRange
2. Compute byte range (everything except /Contents value)
3. Hash and sign with private key
4. Insert signature into placeholder

Requires incremental update capability (PdfReader + append) for signing existing documents.

PAdES (PDF Advanced Electronic Signatures) profile for EU/legal compliance as stretch goal.

Tests: signature dictionary present, byte range covers correct regions, PKCS#7 structure valid, signed PDF verifiable with openssl.