[DICOM] Ensure crypto hash output respects DICOM VR length limits

Summary

DICOM crypto hashing can generate values that exceed the target value representation’s maximum length.

When MatchInputStringLength = false, SHA-256 hashing produces a 64-character hex string. Writing that value to a tag with the SH value representation fails validation because SH permits at most 16 characters.

The pipeline throws:

FellowOakDicom.DicomValidationException

from:

FellowOakDicom.DicomValidation.ValidateSH

Reproduction

1. Configure a DICOM anonymization rule to crypto-hash an SH tag.
2. Set MatchInputStringLength = false.
3. Process a DICOM containing the configured tag.
4. Observe output reconstruction fail because the generated hash exceeds the
   SH length limit.

Expected behavior

The DICOM anonymizer should generate deterministic hash output that conforms
to the target tag’s value representation, including its maximum length.

Acceptance criteria

• Constrain generated values to the target DICOM VR’s maximum length.
• Preserve deterministic hashing.
• Avoid truncation strategies that materially weaken collision resistance
  without documenting the tradeoff.
• Add tests for SH values, including its 16-character boundary.
• Add coverage for other bounded string VRs used by crypto-hash rules.
• Return a clear anonymizer error if a conformant value cannot be generated.
• Do not include source DICOM values in logs or exceptions.