Handling of differing digests in DigestAlgorithmIdentifier and SignatureAlgorithmIdentifier in CMS

Nobody has claimed this yet.

It's possible for the digests specified in DigestAlgorithmIdentifier and SignatureAlgorithmIdentifier to differ. It does not seem to be specified in a standard how to handle such a mismatch. The code should probably handle it explicitly and log a warning.

In the case of post-quantum signatures, the one specified by SignatureAlgorithmIdentifier [is the correct one](https://github.com/lamps-wg/cms-ml-dsa/issues/21#:~:text=However%2C%20if%20we%20included%20the%20SHAKE%20OID%2C%20that%20might%20cause%20these%20old%20CMS%20implementations%20to%20stumble%2C%20hence%20we%27re%20using%20the%20SHA%2D512%20OID%20instead.). Such signatures can use SHAKE but specify SHA-512 OID. So this crate by-default mishandles those.

My personal opinion or feeling is also that the digest specified by SignatureAlgorithmIdentifier is more likely to be the correct one (it's simply more specific) and the DigestAlgorithmIdentifier should only be used if doing stream processing or if SignatureAlgorithmIdentifier does not specify a digest. Even though [OpenSSL usually uses](https://github.com/openssl/openssl/issues/11413#issuecomment-633268402) DigestAlgorithmIdentifier over the one specified in SignatureAlgorithmIdentifier. On the other hand `pyca/cryptography` does the opposite, uses the SignatureAlgorithmIdentifier.

No files, tests, or entry points are named. Start by tracing CMS signature verification where DigestAlgorithmIdentifier and SignatureAlgorithmIdentifier are interpreted, then review the linked CMS and OpenSSL references. Done means the mismatch behavior is explicitly defined, including the post-quantum case, with a warning and tests covering differing digests.

Written by the indexing model from the issue text.