[AKG451]

Secret-key storage in KeyEncapsulation and Signature could be released without cleansing during assignment, regeneration, or failed construction. The move operations also copied secret vectors inside noexcept functions, potentially terminating the process on allocation failure.

This PR updates both wrappers to:

• Cleanse the constructor’s by-value secret-key parameter when initialization fails.
• Complete metadata copying before copying secret bytes during copy construction.
• Use copy-and-swap assignment to preserve the destination on failure and cleanse its previous key after successful replacement.
• Transfer secret-key storage without allocation during moves.
• Generate replacement keys in guarded temporary storage, preserving the existing key on failure and cleansing temporary or replaced secrets.
• Check backend creation results before dereferencing them.

The added lifecycle tests cover copying, moving, self-assignment, empty-key assignment, regeneration, and assignment across algorithms when the selected alternatives are enabled. They check that resulting keys remain usable for encapsulation/decapsulation or signing/verification.

Moves now transfer ownership of the existing allocation rather than copying and wiping the source allocation. The destination becomes responsible for cleansing that storage. Private member order also changes, so consumers should rebuild.

Validation completed:

• C++11 syntax/type checks using dependency stubs.
• Supplemental mock-backend allocation-failure and cleansing tests.
• ASan/UBSan checks of that harness, with LeakSanitizer disabled due to environment limitations.

[AKG451]

@dstebila @baentsch The Windows CI job is failing while compiling liboqs’s SQIsign code:

liboqs/src/sig/sqisign/the-sqisign_sqisign_common/sign.c
error C2065: 'ssize_t': undeclared identifier

This appears unrelated to the files changed in this PR, although I haven’t confirmed the same failure on the base branch. Could you please take a look when convenient? Thank you.