Rewrite http-message-sig with an explicit RFC 9421 API

[thibmeu]

This matches #122 more closely, and should allow for a more informed choice about http-message-sig library.

// Before
const headers = await signatureHeaders(request, { signer });
await verify(request, verifier);

// After
const fields = await createSignature(request, {
  signer,
  components: ["@method", "@authority"],
  parameters: { created, keyid, alg },
});

const result = await verifySignature(request, {
  policy,
  resolveVerifier,
});

Changes:

• explicit components and signature parameters
• byte-oriented, algorithm-bound signers/verifiers
• authenticated verification result
• structured policy and errors
• sync signing via createSignatureSync