Test donor signing templates

[polaz]

Summary

Add integration coverage for signing xmlsec1 donor templates with supported algorithms, and repair the unreleased changelog entries that were lost after dependency branch merge history confused release-plz.

Acceptance criteria

• Supported donor signing templates are copied into local fixtures.
• RSA and ECDSA donor templates are signed with repository key fixtures and verified through the existing verifier.
• Unsupported/blocking donor templates remain excluded when they require not-yet-implemented transforms.
• Local architecture/roadmap docs match the current RustCrypto signing implementation.
• The changelog contains the missing unreleased entries so the next release-plz PR includes the complete release notes.

Testing

• cargo fmt -- --check
• cargo nextest run
• cargo test --doc
• cargo clippy --all-targets -- -D warnings
• cargo build --all-features

[coderabbitai]

🔗 Related PRs

#41 - test(xmldsig): add donor full verification suite accounting [closed]
#44 - test(xmldsig): add real SAML IdP integration coverage [closed]
#72 - feat(xmldsig): resolve X509 selectors [merged]
#74 - feat(xmldsig): add signature template builders [merged]
#81 - feat(xmldsig): write x509 signing key info [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!