fix(hmac): reject empty imported keys

[harrshita123]

Summary

Native HMAC imports currently accept empty key material, while browser implementations reject the same input. This creates inconsistent behavior depending on which backend an application uses.

This change validates the key data in the shared native HMAC import path and rejects empty keys before constructing the native key object. Because raw and JWK imports use the same path, the fix covers both formats without duplicating validation logic.

What changed

• Reject empty native HMAC key material with a FormatException.
• Add regression coverage for:
  • empty raw HMAC keys
  • JWK HMAC keys with an empty k value

Why this matters

An HMAC key must contain key material. Accepting an empty key can hide invalid input and cause code to behave differently between native and browser environments. Rejecting it during import makes the behavior predictable and fails early with a clear error.

Validation

• dart format --output none --set-exit-if-changed .
• dart analyze --fatal-warnings .
• Full VM test suite
• Full Chrome test suite using Dart2JS
• Full Chrome test suite using Dart2Wasm

Fixes #363