Rationalise det and nondet CBOR

[cjen1-msft]

Currently we have:

• Non-det cbor c bindings to evercbor
• det cbor rust bindings in cose-openssl
• non-det cbor rust bindings in tav (also det serialisation for cose_sign1 payload checking)

The plan is to rationalise this into:

• det cbor rust bindings in cose-openssl
• non-det cbor rust bindings in tav

To be clear this means that the public interface (rust and c headers) of tav and cose-openssl become the following:

• tav: deserialisation and validation
• cose-openssl: serialisation and signing

So for tav this means no change, just a more principled position, and cose-openssl gets a new ffi builder api for building a CborDet value and serialising it.

This builder ffi we should probably then expose in our private headers for internal usage.
And we migrate the existing cose constructors over to the builder api.