feat: add CRL support in generation and validation

[Manuthor]

No description provided.

[Copilot]

Pull request overview

This PR expands PKI support across server, CLI, Web UI, and tests by adding CRL generation + public CRL distribution, strengthening CRL-based validation behavior, and updating related KMIP/TTLV and export paths (including PQC Raw export support).

Changes:

• Add CRL generation (authenticated) and public CRL distribution point endpoint (unauthenticated), plus auto-injection of CDP into issued certificates when kms_public_url is set.
• Strengthen certificate validation around CRLs (freshness checks, signature handling) and persist revocation reasons needed for CRL entries; fix TTLV normalization for structured RevocationReason.
• Add PQC key export as KeyFormatType::Raw (non-FIPS) plus new vectors/tests and related documentation/CORS behavior updates.

Reviewed changes

Copilot reviewed 37 out of 38 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
ui/src/menuItems.tsx	Adds a new “Generate CRL” menu entry under Certificates.
ui/src/App.tsx	Registers a new React route for the Generate CRL form.
ui/src/actions/Certificates/CertificateGenerateCrl.tsx	New UI form that calls the CRL REST endpoint and downloads DER/PEM.
documentation/docs/use_cases/pki.md	Documents CRL generation and clarifies unsupported Delta CRLs.
documentation/docs/configuration/tls.md	Adds ANSSI TLS recommendations note.
documentation/docs/configuration/server_configuration_file.md	Clarifies CORS defaults and interaction with kms_public_url.
crate/test_kms_server/src/vector_runner.rs	Extends vector runner with {{hex:...}}, AllocTempFile, and GenerateCrl steps; adds new vector tests.
crate/test_kms_server/src/pqc_export_tests.rs	New non-FIPS PQC export-as-Raw roundtrip tests.
crate/test_kms_server/src/lib.rs	Wires in new CRL and PQC export test modules.
crate/test_kms_server/src/crl_tests.rs	New integration tests covering CRL generation and CRL-based validation lifecycle.
crate/test_kms_server/README.md	Updates vector counts and lists new vectors.
crate/test_kms_server/Cargo.toml	Adds deps needed by new tests/vector-runner capabilities.
crate/server/src/start_kms_server.rs	Registers CRL routes (authenticated + public) in Actix app/scope.
crate/server/src/routes/mod.rs	Adds the new crl routes module.
crate/server/src/routes/crl.rs	Implements authenticated CRL generation and public cached CRL serving.
crate/server/src/core/operations/validate.rs	Tightens CRL validation handling (freshness checks, signature rules, file:// handling, soft-fail for unreachable CRLs).
crate/server/src/core/operations/revoke.rs	Persists revocation reasons/metadata needed for CRL generation.
crate/server/src/core/operations/mod.rs	Exposes the new generate_crl operation module.
crate/server/src/core/operations/generate_crl.rs	Implements CRL generation, selection of revoked certs, and in-memory caching for public serving.
crate/server/src/core/operations/export_get.rs	Adds non-FIPS PQC PKCS#8/SPKI → Raw conversion during export.
crate/server/src/core/operations/certify/subject.rs	Adds detection of existing CDP extension to avoid injecting duplicates.
crate/server/src/core/operations/certify/certify_op.rs	Passes kms_public_url into certificate building for CDP injection.
crate/server/src/core/operations/certify/build_certificate.rs	Injects server CDP extension when appropriate; adds DER length helper.
crate/server/src/config/params/server_params.rs	Automatically includes kms_public_url in default CORS allow-list when cors_allowed_origins is unset + adds unit tests.
crate/server/documentation/openapi.yaml	Documents new CRL endpoints in OpenAPI.
crate/kmip/src/ttlv/normalize.rs	Fixes AttributeValue normalization to preserve structured types; adds regression tests.
crate/kmip/src/kmip_0/kmip_types.rs	Adds vendor-extension revocation reason codes required for CRL completeness.
crate/crypto/src/openssl/mod.rs	Exposes new OpenSSL CRL module.
crate/crypto/src/openssl/crl.rs	New OpenSSL-sys based CRL builder implementation + unit tests.
crate/crypto/src/crypto/pqc/mod.rs	Adds PKCS#8/SPKI → Raw extraction helpers + tests for conversion roundtrips.
crate/crypto/Cargo.toml	Adds deps needed by new OpenSSL CRL builder module.
crate/clients/client/src/kms_rest_client.rs	Adds get_bytes() helper for non-JSON REST responses (DER/PEM).
crate/clients/client/src/http_client/login.rs	Fixes OAuth callback server startup race by pre-binding the callback port.
crate/clients/clap/src/actions/certificates/mod.rs	Registers new ckms certificates generate-crl command.
crate/clients/clap/src/actions/certificates/generate_crl.rs	Implements CLI action calling REST CRL endpoint and writing output file.
crate/clients/ckms/src/tests/certificates/certify.rs	Updates test expectations for CDP URL fixture.
CHANGELOG/fix_put_kms_public_url_in_allowed_cors_by_default.md	Adds branch-specific changelog entries covering CRL, PQC export, CORS, and related changes.
Cargo.lock	Updates lockfile for newly added dependencies.