crypto: prevent Hmac.digest() from returning uninitialized memory after stream use

[mcollina]

Hmac.prototype._flush was aliased to Hash.prototype._flush, which finalizes the native HMAC context but never sets the JavaScript-side kFinalized flag. After an Hmac has been used as a stream, a subsequent Hmac.prototype.digest() call therefore still believes the object has not been finalized and calls into C++ a second time. On that second call the native context has already been reset, so the digest buffer is never written and Digest::MAX_SIZE bytes of uninitialized stack memory are returned to JavaScript.

Hash is not affected because Hash::HashDigest caches its digest (refs #28245); Hmac never received the equivalent protection.

This gives Hmac its own _flush that sets kFinalized, so repeat digest() calls after stream use are handled by the existing DEP0206 guard. As defense in depth, it also sets buf.len = 0 on the native side when the context has already been reset, so unwritten bytes can never be emitted. A regression test covers the stream-then-digest() path.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 87.50000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.13%. Comparing base (e6a8d06) to head (49e88ce).
⚠️ Report is 946 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_hmac.cc	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65112      +/-   ##
==========================================
- Coverage   92.01%   90.13%   -1.88%     
==========================================
  Files         379      751     +372     
  Lines      166972   252304   +85332     
  Branches    25554    47442   +21888     
==========================================
+ Hits       153639   227425   +73786     
- Misses      13041    16197    +3156     
- Partials      292     8682    +8390     

Files with missing lines	Coverage Δ
lib/internal/crypto/hash.js	98.17% <100.00%> (-0.85%)	⬇️
src/crypto/crypto_hmac.cc	68.71% <50.00%> (ø)

... and 601 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76323/