Centralize PKCS#11 Backend Selection via String Flag Union and Transition to Rust Cryptoki Default

### What

Child of #49

**Description:**
Update the default value of the pkcs11_backend Bazel label flag in score/crypto/src/backend/BUILD to point directly to S-CORE's secure
Rust wrapper (//score/cryptoki:cryptoki_cdylib_wrapped) by default, officially making Rust S-CORE's primary PKCS#11 provider. SoftHSM
will become S-CORE's fallback emulator.

Additionally, we introduce strict Union/Enum pattern for all available backends. By replacing S-CORE's current label_flag with S-CORE's centralized string_flag, we mathematically prevent developers from introducing conflicting, independent
flags in the future, providing deterministic compile-time mutual exclusion and strict repository governance.

### Acceptance Criteria (DoD)

[ ]The repository compiles, builds, and runs under S-CORE's secure Rust backend by default when running standard Bazel commands (bazel build //...) without any flags.
[ ] String Flag Union: S-CORE's pkcs11_backend label flag is replaced with S-CORE's centralized string_flag named pkcs11_provider.

### How

_No response_

Start in score/crypto/src/backend/BUILD and inspect the current pkcs11_backend label flag and the existing centralized string_flag pattern. Run bazel build //... without flags to establish the current behavior. Done means the default selects //score/cryptoki:cryptoki_cdylib_wrapped and the provider uses the centralized pkcs11_provider string flag.

Written by the indexing model from the issue text.