componentize shim: IDL-coercion and exception-type divergences on exotic inputs

[lann]

Low-severity spec-fidelity items in js/componentize/webcrypto.js (the shim has no WebIDL layer, so coercions are hand-rolled and currently inconsistent):

• GCM_LEGAL_TAG_LENGTHS.includes(alg.tagLength) (2201) is strict — string "128" throws where platforms coerce and accept; the neighboring AES-CTR check uses Number() (2184).
• rsaPssSaltLengthOf (994-999) and the PBKDF2 iterations check (1255-1257) reject non-integers with TypeError; [EnforceRange] unsigned long truncates toward zero first.
• deriveBits with a fractional length on X25519/ECDH (2737-2741) feeds a fractional shift count into the sub-byte mask — different output bits than a platform's coerced integer length.
• normalizeAlgorithm/normalizeHashName throw TypeError for non-string name/hash (670-672, 706-708) where IDL stringifies first.
• HMAC get-key-length for length: 0 in the deriveKey/unwrapKey target path throws OperationError (2779-2781, 2620-2622) where the spec's Get Key Length says TypeError (generateKey's OperationError at 1951-1953 is correct).
• getRandomValues over a detached buffer throws TypeError (2937-2947); platforms return the array untouched.
• Cosmetic: the Iface import-alias suffix distributes arbitrarily (156-176; rsassaVerify vs rsaPssVerifyIface from the same commit).

None are observable by the vendored WPT subset; each is a caller-visible divergence on exotic input.