Add JWE content-encryption support for the AES-CBC-HMAC-SHA2 family

## Summary
Add JWE content-encryption support for the AES-CBC-HMAC-SHA2 family (`A128CBC-HS256`, `A256CBC-HS512`) per RFC 7518 §5.2, alongside the existing AES-GCM support.

The `direct_post.jwt` JARM implementation currently supports only `A128GCM` /`A256GCM` content encryption. Verifiers can legitimately advertise CBC-HMAC `enc` values, and a Verifier advertising *only* CBC-HMAC cannot currently be encrypted to the encryption path returns `UnsupportedAlgorithm`.

## Implementation notes

- Add `A128CbcHs256` and `A256CbcHs512` variants to `ContentEncryptionAlgorithm`.
The enum is `#[non_exhaustive]`, so adding variants is **non-breaking** for
external callers.
- The compiler will force new match arms wherever the enum is matched. Known
thread-through points:
- `ContentEncryptionAlgorithm::key_len()` (CBC-HMAC keys are double-length:
`A128CBC-HS256` = 32 bytes total split into 16-byte MAC key + 16-byte enc key;
`A256CBC-HS512` = 64 bytes total split 32/32).
- the encrypt / decrypt content-encryption dispatch in `jwe/encrypt.rs` /
`jwe/decrypt.rs`.
- `jwk_km_to_jwe_alg` and any sibling alg/enc mapping in
`cloud-wallet-openid4vc`.
- Mind the CBC-HMAC key split: the derived CEK is partitioned into MAC key (first
half) and encryption key (second half) per RFC 7518 §5.2.2.1 — this differs
from GCM where the whole CEK is the encryption key.

## Testing

- [ ] RFC 7518 **Appendix B** known-answer test vectors for both
`A128CBC-HS256` and `A256CBC-HS512` (the spec ships these — use them as the
primary KAT).
- [ ] Roundtrip encrypt/decrypt tests for both variants.
- [ ] Tamper-detection test (flipped ciphertext / tag byte → decryption fails).
- [ ] Interoperability test against an external JOSE implementation
(joserfc-style external-sender token), mirroring the existing GCM interop
tests.
- [ ] Wrong-length / malformed-IV rejection test.

## Acceptance criteria

- [ ] `A128CBC-HS256` and `A256CBC-HS512` are selectable `enc` values an encrypt/decrypt correctly.
- [ ] Implementation follows RFC 7518 §5.2 (including §5.2.2.1 MAC input formatting and the MAC/enc key split).
- [ ] Tag verification is constant-time.
- [ ] RFC 7518 Appendix B KAT vectors pass for both algorithms.
- [ ] Existing GCM behaviour is unchanged (no regression).
- [ ] A Verifier advertising only CBC-HMAC `enc` values can be encrypted to end-to-end.

Start with ContentEncryptionAlgorithm::key_len() and the AES-GCM dispatch in jwe/encrypt.rs and jwe/decrypt.rs, then inspect jwk_km_to_jwe_alg and sibling mappings in cloud-wallet-openid4vc. Use RFC 7518 §5.2 Appendix B vectors first, followed by roundtrip, tamper, malformed-IV, and existing GCM interoperability tests; done means both CBC-HMAC variants work without changing GCM behavior.

Rédigé par le modèle d'indexation à partir du texte de l'issue.