fix(secure_buffer): wipe before resize reallocation

[LimiNode]

Summary

• wipe the old allocation before resize can release it
• coordinate page locks process-wide by normalized page address and reference count, preventing overlapping secure buffers from unlocking one another
• roll back page locks after a partial lock failure
• allocate and lock zeroed replacement storage before copying a secret in resize, copy construction/assignment, string construction, and assign
• wipe consumed std::string sources on both success and exception paths
• reject element counts whose byte size would overflow
• add independent secure-buffer and page-registry regression coverage
• run the whole CTest suite in Linux, macOS, and Windows CI, with HMACCPP_ENABLE_MLOCK=ON/OFF

ABI and release policy

• This is an ABI-breaking 0.6.0 change: secure_buffer layout and move exception specifications changed.
• Shared-library consumers must rebuild against the new headers and library; 0.6.0 is not a drop-in DLL/SO replacement for 0.5.x.
• The bundled vcpkg port remains pinned to the latest tagged release until v0.6.0 is published.

Verification

• Windows / MinGW: full available CTest suite passed with HMACCPP_ENABLE_MLOCK=ON
• Windows / MinGW: test_secure_buffer passed with HMACCPP_ENABLE_MLOCK=OFF
• Windows / MinGW: test_secure_buffer passed with CMAKE_CXX_STANDARD=11
• test_all is skipped locally only because OpenSSL is not installed

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.