feat(xslt): implement standalone XSLT 1.0 engine

[polaz]

Summary

• add a reusable safe-Rust XSLT 1.0 compiler and runtime with explicit resolver, clock, extension, and resource-budget contracts
• replace quick-xml with one bounded lexical XML layer shared by the core security pipelines and XSLT, with selectable xmloxide and roxmltree semantic backends
• harden XML, XPath, XInclude, DTD, serialization, and XMLDSig transform behavior against normative edge cases and adversarial resource use
• enforce transitive memory and aggregate-work budgets across projections, XPath coercions, URI handling, extensions, and retained collection growth
• keep the safe vendored DOM/XPath implementation as the default while retaining an explicit raw-pointer backend profile
• preserve a validated no_std + alloc path for shared XML decoding and lexical scanning
• update all direct dependencies to current releases
• pin applicable normative editions and publisher references; enforce RFC 10007 CRL issuer KeyUsage requirements with the v1/v2 exception

Validation

• cargo nextest run --workspace --all-features --no-fail-fast (3004/3004)
• complete pinned libxslt oracle corpus (554/554)
• workspace all-feature build and clippy with warnings denied
• workspace doctests and formatting
• minimal xmloxide, minimal roxmltree, differential, and fat-backend profiles in CI
• focused XSLT (730/730), safe XPath (302/302), and raw-pointer XPath (301/301) tests
• alloc-only XML input checks on the host and thumbv7em-none-eabihf
• resolved dependency graph contains no quick-xml; all direct dependencies are current

Closes #141

Summary by CodeRabbit

• New Features

  • Added safe-Rust XSLT 1.0 compilation, XPath evaluation, serialization, extension functions, resource resolution, and execution budgets.
  • Added XML byte decoding, broad encoding support, byte-based parsing, size limits, and namespace-binding limits.
  • Added XML input and XSLT workspace crates.

• Bug Fixes

  • Improved handling of malformed, unsupported, oversized, and namespace-intensive XML.
  • Improved certificate revocation checks for version-specific key-usage requirements.

• Documentation

  • Expanded XSLT, interoperability, installation, capabilities, and standards guidance.

• Tests

  • Added extensive libxslt 1.1.45 compatibility and allocation-limited validation.