ML-DSA (FIPS 204) support in the PKCS#11 provider

Cloud KMS added GA support for ML-DSA signing (PQ_SIGN_ML_DSA_44/65/87, including the _EXTERNAL_MU variants) via the core API. Is there a roadmap for bringing the same algorithms to this PKCS#11 provider (libkmsp11)?

**What we checked:** the user_guide.md mechanism list and release notes through v1.9 don't mention CKM_ML_DSA or any post-quantum mechanism, so as far as we can tell ML-DSA keys aren't usable through this provider today — only through the KMS API/client libraries directly.

**Why it matters for us:** we're migrating a build-signing pipeline (currently RSA via openssl smime -engine pkcs11) to add ML-DSA signatures for CNSA 2.0 compliance. Our existing pipeline is built entirely around this PKCS#11 provider, so the lack of ML-DSA support here means we have to build a parallel, PKCS#11-independent signing path using the KMS SDK directly instead of extending our existing integration.

**Ask:**
Is ML-DSA/PQC support planned for libkmsp11, and if so, roughly when?
If it's not planned, is that a permanent limitation (e.g. PKCS#11 spec support for the new mechanism identifiers is still in flux — we've seen references to CKM_ML_DSA/CKP_ML_DSA_* landing in PKCS#11 v3.1) or just not yet prioritized?

Start with user_guide.md's mechanism list and the release notes through v1.9, then review how the provider currently represents PKCS#11 mechanisms. Compare that support with CKM_ML_DSA, CKP_ML_DSA_*, and the PQ_SIGN_ML_DSA_44/65/87 variants named in the issue. Done means establishing whether ML-DSA can be supported here and documenting a concrete implementation or roadmap decision.

Written by the indexing model from the issue text.