ci: add FFI memory-safety test lane

[HamdaanAliQuatil]

Closes #278

This adds a focused VM-only memory-safety test for the native FFI path and runs it under Valgrind on Linux CI.

What this covers:

• AES-GCM, HMAC, ECDH, and RSA-OAEP operations through the public API.
• key export/import ownership paths for raw, JWK, PKCS8, and SPKI formats.
• failed native imports followed by valid native operations, to exercise cleanup-after-error paths.
• repeated short-lived allocations between native operations to put some pressure on Dart object lifetimes/finalizers.

The new CI job uses dart test, not dart test -c exe, because the normal dart test path supports native build hooks today. Sanitizer support for hook-built code is still blocked upstream, so this starts with Valgrind memcheck instead.

Valgrind is configured to show definite and possible leaks, but only fail on definite leaks. Possible leaks can include runtime noise from the Dart VM, so this keeps the first lane useful without making it too brittle.

[jonasfj]

May I suggest we re-organize this a bit.

test/
  ffi/
    valgrind_test.dart     // void main() => test( => process.runSync(valgrind...
    valgrind_target.dart   // void main() {...

So that valgrind_test.dart is annotated @TestOn('vm') and it has:
if(!linux) { markTestSkipped('only test on linux'); return; }

Probably, we could even run Process.runSync(which valgrind and skip the test if valgrind is not installed.

valgrind_target.dart is just a main with print("#symmetric operations survive memory pressure") doesn't use package:test, it can still throw AssertionError or use package:checks to make assertions. But it's really not about testing logic, it's about calling methods and doing memory pressure things and letting valgrind have some behavior that it can inspect.