[KeyManager] Expose Granular Error Codes in FFI

[atulpatildbz]

The current Rust FFI implementation for key_protection_service collapses most logical errors (e.g., UnsupportedAlgorithm, InvalidKey, CryptoError) into a generic error code -1. Only buffer size mismatches return a specific code (-2).

This prevents the Go client code from providing meaningful diagnostics to users (e.g., distinguishing between a bad key and an unsupported algorithm).

Proposed Change:

• Rust Side:
  Update key_manager_generate_kem_keypair (and other FFI functions) to return specific error codes corresponding to km_common::crypto::Error variants.
  Example:

  • -3: UnsupportedAlgorithm
  • -4: InvalidKey
  • -5: CryptoError

• Go Side:
  Update the CGO wrapper in kps_key_custody_core_cgo.go to handle these specific error codes and translate them into idiomatic Go errors with clear messages for the client.
  Example:

  if rc == -3 {
      return ..., fmt.Errorf("unsupported algorithm configuration")
  }

we can also rely on cbindgen to export C constants for these error codes (e.g., C.KM_ERR_UNSUPPORTED_ALGORITHM) or define equivalent Go constants if that's not possible

discussion: #652 (comment)