Add OpenPGP and S/MIME signing of outgoing mail

mail.pgp.signing.type selects NONE (default), OPENPGP or SMIME, with one
key/certificate per From address.

- OPENPGP: plaintext copies become PGP/MIME multipart/signed (RFC 3156 s5,
  detached signature over the exact content entity bytes); encrypted copies
  are signed inside the encryption (combined method)
- SMIME: plaintext copies become S/MIME multipart/signed (RFC 8551, via
  Bouncy Castle bcjmail); encrypted copies are S/MIME-signed, then
  PGP/MIME-encrypted
- signed bodies are attached as raw bytes so they reach the wire unchanged;
  shared MIME helpers move to MimeEntities
- keys are validated at startup (signing capability, address match,
  validity, passphrase / key-certificate match)
- mail.pgp.signing.required refuses mail from addresses without a key
  (MailSigningException); RELAY mode signs before handing over
- SendReport.signature(), metric tag signature, refused{cause}
- core test-jar shares key/certificate and verification helpers
- end-to-end tests verify signatures on the bytes received over SMTP

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G71TQ5jDETVwdUJxGAwaiT

mailsender-demo/src/main/resources/application.yml

@@ -24,6 +24,17 @@ mail:
     # Readable sent copies: the sender's own PUBLIC key per From address.
     # sender-keys:
     #   "[noreply@example.com]": file:/etc/mail/noreply.pub.asc
+    # Signing with the From address's key: NONE | OPENPGP | SMIME
+    signing:
+      type: ${MAIL_PGP_SIGNING_TYPE:NONE}
+    #   openpgp:
+    #     "[noreply@example.com]":
+    #       key: file:/etc/mail/noreply.sec.asc
+    #       passphrase: ${SIGNING_PASSPHRASE}
+    #   smime:
+    #     "[noreply@example.com]":
+    #       keystore: file:/etc/mail/noreply.p12
+    #       password: ${SMIME_PASSWORD}
     relay:
       host: ${RELAY_HOST:}
       port: ${RELAY_PORT:587}