Stop advertising unsupported RSA signatures in DTLS 1.2

[xnorpx]

Summary

Stop advertising RSA/SHA-256 and RSA/SHA-384 as supported DTLS 1.2 signature algorithms. Dimpl recognizes these wire values for parsing, but its signature implementations support only ECDSA.

Why

RSA support was removed from dimpl, but the DTLS 1.2 SignatureAndHashAlgorithm::supported() list still included RSA. That list feeds both the default signature_algorithms extension and server-side CertificateRequest algorithm selection.

As a result, dimpl could advertise RSA to a peer even though it could not complete the corresponding signature verification. A peer selecting an advertised RSA algorithm could therefore cause the handshake to fail. The advertisement was also inconsistent with the ECDSA client certificate type requested by the server.

Changes

• Separate recognized wire algorithms from algorithms dimpl can actually use:
  • all() retains ECDSA and RSA values so incoming messages remain parseable.
  • supported() now contains only ECDSA/SHA-256 and ECDSA/SHA-384.
• Size SignatureAndHashAlgorithmVec from the recognized set so parsing mixed ECDSA/RSA input remains bounded without losing recognized values.
• Build the default DTLS 1.2 signature_algorithms extension from the supported set.
• Restrict CertificateRequest signature selection to algorithms supported by dimpl's verifiers.
• Add regression coverage for parsing/filtering, serialization, algorithm classification, and server-side selection.

Testing

• cargo fmt --all -- --check
• cargo test --all-features
  • 565 passed
  • 2 ignored
  • 0 failed

[algesten]

@xnorpx

The parser already consumes and discards signature algorithms we don't support. The ArrayVec therefore only ever contains algorithms from supported(), which is the same pattern we use for named groups and DTLS 1.3 signature schemes.

Sizing it from all() reserves space for values that can never be stored and breaks that invariant. Keep all() as the set of recognised wire values, but size the parsed collection from supported().

And I added a test.