refactor: replace PyCryptodome with cryptography

[ZhuoZhuoCrayon]

Summary

• replace pycryptodomex with cryptography for RSA and AES
• preserve existing RSA/AES formats, CFB8 semantics, GCM metadata framing, and public API behavior
• accept PEM and OpenSSH RSA public keys directly without a compatibility adapter
• centralize supported symmetric mode sets as cached SymmetricMode class methods

Verification

• make lint
• uv run pytest -q (90 passed)
• uv run --with cryptography==44.0.0 pytest -q (90 passed)
• uv run --isolated --python 3.14 --all-extras --group dev pytest -q (90 passed)
• uv build
• bidirectional RSA-OAEP-SHA256 and AES-CBC/CTR checks against BK-KMS Go and C++ implementations
• BK-KMS Python branch protocol vectors