Replace deprecated jsrsasign dependency in @azure/attestation

[Jeremy Meng (jeremymeng)]

Copilot agent (on behalf of Jeremy Meng (@jeremymeng)): This PR replaces the deprecated jsrsasign production dependency in @azure/attestation while preserving its synchronous GA token APIs and Node >=22, browser, and React Native build targets.

Design

• Uses audited @noble/curves P-256 primitives for synchronous ES256 signing and verification.
• Uses patched node-forge 1.4+ for synchronous RS256/PKCS#1 v1.5 instead of hand-rolling modular exponentiation, padding, or DigestInfo encoding.
• Imports only Forge's ASN.1, RSA, and SHA-256 modules in production. The measured minified+gzip crypto bundle is about 51 KB total, compared with about 95 KB when importing Forge's default entrypoint.
• Adds a private, narrowly scoped DER reader for PKCS#8 and X.509 SubjectPublicKeyInfo extraction. It rejects indefinite, non-canonical, truncated, malformed, and trailing encodings, validates RSA/P-256 structures, and compares private keys with certificate public keys.
• Preserves RS256, ES256, unsecured (alg: none) tokens, canonical x5c encoding, token validation, tamper rejection, and private-key/certificate matching.
• Derives certificate kty from the subject public-key algorithm rather than the certificate issuer's signature algorithm.

jose was explicitly evaluated but was not usable here because its Web Crypto operations are asynchronous and would break the stable synchronous API. A separate X.509 dependency was not needed.

Dependencies and security

• Removes jsrsasign.
• Adds @noble/curves: ^2.0.1 (MIT; lockfile resolves 2.3.0).
• Adds node-forge: ^1.4.0 (BSD-3-Clause licensing option; lockfile resolves 1.4.0). The minimum version excludes earlier RSA signature-forgery vulnerabilities, and verification additionally enforces the RSA modulus signature length.
• Adds @types/node-forge: ^1.3.13 as a development dependency.
• Updates the scoped third-party dependency approvals and generated lockfile state.

Validation

• pnpm format and pnpm check-format
• pnpm lint (no errors; four existing no-param-reassign warnings)
• pnpm turbo build --filter=@azure/attestation... --token 1 (browser, React Native, ESM, CommonJS, and API extraction)
• pnpm build:samples
• pnpm test:node — 44 passed, 5 skipped across 6 files
• pnpm test:browser — 49 passed, 5 skipped across 7 files in Chromium

The regression coverage includes SDK-to-Node and Node-to-SDK RS256/ES256 interoperability, browser-native RSA/EC paths, tampered tokens, malformed signing material, and mismatched RSA/EC keys.

Remaining limitation

The package has no React Native device/runtime test harness. The React Native target compiles successfully, and the same isomorphic dependency graph bundles and executes in Chromium without Node built-ins.

Fixes #39762

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
9 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.