feat(protocol): add PSK authentication provider

[Jason-Morcos]

Merge order

1. refactor(protocol): add certificate authentication provider #31 — no-behavior-change CertificateAuth refactor
2. This PR — PskAuth
3. Follow-up — opt-in certificate server/profile verification

This branch is stacked directly on exact #31 head 8fb37ca. Please merge #31 first; this PR's independent change is commit 2a6fc62. I will rebase or restack it after #31 if the merge method requires that.

Summary

• add immutable PskAuth for an existing raw OCF identity and PSK
• require exact bytes inputs, a 16-byte NUL-free identity, and a 16- or 32-byte key
• configure only ECDHE-PSK-AES128-CBC-SHA256, with no certificate-suite fallback or global OpenSSL change
• keep the CFFI callback as the sole credential owner and retain it through the session-owned provider lifetime
• fail before touching either OpenSSL destination buffer when either buffer is null or too small
• keep credentials out of public fields, dataclass serialization, equality/hash behavior, representations, and error paths

Scope boundary

This is the pure PskAuth slice agreed in #28. It consumes a credential that the caller already holds.

It does not derive, discover, acquire, persist, rotate, provision, or write credentials; perform ownership transfer or OTM; access Samsung cloud/account services; add certificate server profiles; or change session lifecycle behavior.

Consequently, it does not by itself solve #16 or #20. The former still needs an authorized identity and later opt-in profile support; the latter requires credential acquisition/vendor OTM outside this package.

Validation

• Python 3.13 with current dependencies: 163 passed
• Python 3.11 with cbor2 5.6.0, pyOpenSSL 23.1.0, and pytest 8.0.0: 163 passed
• current LocalThings consumer suite against this branch: 1,070 passed
• real OpenSSL PSK callback installation verified on dependency-floor and current pyOpenSSL
• targeted Ruff checks, compileall, share-safety scan, distribution-content check, and isolated wheel/sdist imports passed

Part of #28.