fix(secure_buffer): wipe before resize reallocation

[LimiNode]

Summary

Hardens secure_buffer page-lock ownership and failure handling while preserving the previous resize/copy/move security fixes.

• Separates logical page owners from the OS-lock state in the process-wide page registry. A failed OS unlock leaves a retryable sticky physical lock with zero owners; it cannot be mistaken for a live owner or unlock another buffer's range.
• Handles mutex-acquisition and registry allocation failures inside the noexcept public registry API by returning false instead of terminating.
• Requires PageLocker::lock_page() and unlock_page() to be noexcept.
• Adds regression coverage for failed unlock/retry, overlapping mixed ranges, rollback-unlock failure, mutex failure, and partial page-state insertion failure. The allocation-failure test verifies that no OS lock is called and prepared entries are removed.
• Fixes the temporary PageLockGuard in pbkdf2_secure() to release its reference after the returned secure_buffer has registered its own.
• Uses exact CMake package-version compatibility for the pre-1.0 0.6.0 release.
• Documents registry scope and POSIX fork-without-exec limitations for page locking.

Verification

• ctest with HMACCPP_ENABLE_MLOCK=ON: test_secure_buffer and test_totp pass (test_all skipped locally because OpenSSL is not installed).
• ctest with HMACCPP_ENABLE_MLOCK=OFF: test_secure_buffer passes.
• test_secure_buffer also builds and passes with CMAKE_CXX_STANDARD=11.
• git diff --check passes.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.