Reworked encryption to use less heap allocated buffers for secrets.

Also some work on plugin system.

IdentityShroud.Core.Tests/Security/Jwt/RsaJwtSignerTests.cs

@@ -0,0 +1,48 @@
+using System.Security.Cryptography;
+using IdentityShroud.Core.Contracts;
+using IdentityShroud.Core.Model;
+using IdentityShroud.Core.Security;
+using IdentityShroud.Core.Security.Keys;
+using IdentityShroud.Core.Services;
+
+namespace IdentityShroud.Core.Tests.Security.Jwt;
+
+public class RsaJwtSignerTests
+{
+    [Fact]
+    public void Test()
+    {
+        // ISecretProvider secretProvider = Substitute.For<ISecretProvider>();
+        // RealmSigningKey privateKey = new()
+        // {
+        //     Id = default,
+        //     KeyType = KeyType.RSA,
+        //     Key = new EncryptedDek(KekId.NewId(), [1]),
+        //     CreatedAt = default,
+        //     RevokedAt = null,
+        //     Priority = 0,
+        //     PublicKeyParameters = null
+        // };
+        DecryptedSigningKey key = new();
+        byte[] jwt = [];
+
+        RsaJwtSigner provider = new();
+        provider.CalculateSignature(JwtSigAlgName.RS256, key, jwt);
+        //
+        // new DekEncryptionService(secretProvider), privateKey,
+        //     JwtSigAlgName.RS256);
+    }
+
+    [Theory]
+    [InlineData(1024)]
+    [InlineData(2048)]
+    [InlineData(4096)]
+    public void EstimateKeySizeTests(int keySizeBits)
+    {
+        using var rsa = RSA.Create();
+        rsa.KeySize = keySizeBits;
+        byte[] b = rsa.ExportPkcs8PrivateKey();
+        int estimate = DecryptedSigningKey.EstimatePkcs8ExportSize(keySizeBits);
+        Assert.True(b.Length < estimate - 100);
+    }
+}