Proposal: Implement "Modern Algorithms in the Web Cryptography API" (WICG specification)

The WICG is incubating a specification that adds post-quantum secure and modern cryptographic algorithms to the Web Cryptography API, much like X25519 was incubated before being merged into [Web Cryptography](https://w3c.github.io/webcrypto/): https://wicg.github.io/webcrypto-modern-algos/

Adoption is well underway, see [Implementation status](https://github.com/WICG/webcrypto-modern-algos/issues/25).

The specification's [Adoption Guidance](https://wicg.github.io/webcrypto-modern-algos/#adoption-guidance) section recommends the following implementation priorities:

1. **ML-KEM** (FIPS 203) — post-quantum key encapsulation mechanism. Combined with traditional key agreement it enables hybrid PQ/T key establishment as used in protocols like HPKE and its [PQ and PQ/T algorithms](https://datatracker.ietf.org/doc/draft-ietf-hpke-pq/). ML-KEM requires new `SubtleCrypto` methods: `encapsulateKey`, `encapsulateBits`, `decapsulateKey`, and `decapsulateBits`.
2. **ML-DSA** (FIPS 204) — post-quantum digital signature algorithm.
3. **ChaCha20-Poly1305** (RFC 8439) — widely deployed AEAD cipher used across TLS, SSH, WireGuard, HPKE.
4. **SHA-3** (FIPS 202) — `SHA3-256`, `SHA3-384`, `SHA3-512` hash functions.
5. **cSHAKE** (NIST SP 800-185) — `cSHAKE128`, `cSHAKE256` extendable-output functions used in post-quantum constructions including ML-KEM key derivation and hybrid KEM combiners. When invoked without customization parameters, cSHAKE produces output identical to SHAKE.
6. **TurboSHAKE** (RFC 9861) — `TurboSHAKE128`, `TurboSHAKE256` XOFs based on round-reduced Keccak, roughly twice as fast as SHAKE.

The specification also introduces two important new `SubtleCrypto` methods that benefit all algorithms (including those already in Web Crypto):

- **`SubtleCrypto.supports(operation, algorithm)`** — synchronous feature detection for algorithm/operation support. This is critical for enabling progressive enhancement and graceful fallback as runtimes adopt these algorithms incrementally.
- **`SubtleCrypto.prototype.getPublicKey(key, keyUsages)`** — derives a public key from an asymmetric private key, simplifying key management and enabling protocols that commit the public key value to their outputs while accepting non-extractable private keys as input.

Web Platform Tests (WPTs) for the specified algorithms and operations are available.

Start by reading the WICG Web Cryptography Modern Algorithms specification and its Adoption Guidance, then review the available Web Platform Tests. The issue covers multiple algorithms and new SubtleCrypto methods, but names no repository files or implementation entry points. Done would require implementing a defined subset of the specification and passing the relevant WPTs.

Written by the indexing model from the issue text.