Harden cross-runtime signature verification

[jt55401]

This updates the shared canonicalization and verification bindings before downstream lock refreshes.

Changes:

• enforce registered algorithms, key types, ECDSA curves, and canonical signature encodings across runtimes
• parse structured JSON key documents in the JavaScript direct URL resolver
• align the root package metadata with canonicalization v0.2.1

Validation:

• JavaScript: 48 passed in Node 22 container
• Python: 43 passed in container
• PHP: 97 tests, 145 assertions in container
• Go: package tests passed in container
• Rust: 15 tests passed with an isolated Cargo target directory