It is sometimes useful to encrypt data under some symmetric key.
While this was possible to do using passphrase-derived keys, there was
no support for long-term storage of the keys that was used to encrypt
the key packets.

To solve this, a new type of key is introduced. This key will hold a
symmetric key, and will be used for both encryption and decryption of
data. Specifically, as with asymmetric keys, the actual data will be
encrypted using a session key, generated ad-hoc for these data.
Then, instead of using a public key to encrypt the session key, the
persistent symmetric key will be used instead, to produce a, so to say,
Key Encrypted Key Packet.

Conversly, instead of using a private key to decrypt the session key,
the same symmetric key will be used. Then, the decrypted session key
can be used to decrypt the data packet, as usual.

As with the case of AEAD keys, it is sometimes useful to "sign"
data with a persistent, symmetric key.

This key holds a symmetric key, which can be used for both signing and
verifying the integrity of data. While not strictly needed, the
signature process will first generate a digest of the data-to-be-signed,
and then the key will be used to sign the digest, using an HMAC
construction.

For technical reasons, related to this implenetation of the openpgp
protocol, the secret key material is also stored in the newly defined
public key types. Future contributors must take note of this, and not
export or serialize that key in a way that it will be publicly availabe.

Since symmetric keys do not have a public and private part, there is no
point serializing the internal "public key" structures. Thus, symmetric
keys are skipped when serialing the public part of a keyring.

Squashed commits:
Update KDF to use SHA3-256
[5ff62f7] WIP: bump to draft-ietf-openpgp-pqc-01
[3949477] Import CIRCL fork with ML-KEM and ML-DSA
[5033a18] Update implementation from draft v1 to v3
- Remove v6 binding for PQC KEMs
- Update KDF
- Update reference comments
- Rename SPHINCS+ to SLH-DSA
- Rename Dilithium to ML-DSA
- Rename Kyber to ML-KEM
- Add vectors generated with RNP
- Fix misc bugs and improve tests
[c53e2e3] Add benchmarking
[d832873] Add read-write tests
[8254a42] Bind PQC packets to v6
[21f33d3] Change testdata for Kyber keys and prepare for v6 PKESK
[fa295de] Change domain separation
[c5bc3c1] Add SPHINCS+ signature support
[603ced6] Add references and clean code
[9b26049] Prefer PQ keys
[6e5ec9c] Add hybrid Kyber + ECDH, Dilithium + EC/EdDSA support
[4d1ed63] Adapt PQC to the v2 API
[3661202] Remove sphincs PQC logic
[2a463c8] Remove PQC algorithms with brainpool and nist curves
[29ee4e6] Update links to PQC draft-rfc
[a75af1c] feat: Update to latest circle version
[587aac2] feat: Derive ML-DSA keys from seed
[ec6b930] feat: Fallback to AES256 if all recipients are PQ
[1c0666f] refactor:  Improve mlkem readability
[5d56595] feat: Integrate review feedback
[cd836af] feat: Update circl to v1.5.0
[902b302] chore: Add kmac back
[cee95ab] feat: Update to new kmac key combiner in kem
[086f153] Disallow v4 PQC KEM keys
[2440667] feat: Add seed format for ML-KEM
[3052ac2] feat: Integrate ML-DSA seed fromat
[c00cd40] feat: Update kem key combinder to latest version
[9677cf4] feat: Avoid panic on key size in kmac
[1bd89db] fix: Kem key combiner should use the kmac correct key
[28848f7] feat: Force SHA3 for ML-DSA
[6faefab] feat: Enforce SHA3 in clearsing API in ML-DSA
[5de74a1] refactor: Add HandleSpecificHash method on PublicKeyAlgorithm

This reverts commit 63e3da1.

This reverts commit 99debaa.