Include info/requirements about Post Quantum Cryptography

It might be time to include requirements and appendix data about PQC.

In particular, two main issues might need to be addressed now (AFAIU):

• "Harvest Now and Decrypt Later" attacks which would motivate transitioning to PCQ public-key encryption now;
• long-time signatures which might get broken at some point.

Things which might need modifications:

• Use hybrid classic/post-quantum cryptography for public-key encryption.
• Consider avoiding ECC for digital signature for long-term signatures? (Because they would hypothetically break faster than RSA signatures)? → use either hybrid signatures or if not possible RSA signatures in this case (?)
• Add PQC primitives in the appendix.

See #3140

Start by reviewing issue #3140 and the current ASVS requirements and appendix sections that would need PQC coverage. Define the accepted guidance for hybrid encryption, long-term signatures, and PQC primitives, then update the relevant requirements and appendix data so these concerns are explicitly addressed.