Add PKCS#11 3.2 attribute to NSSDB storage

[simo5]

Description

This catches up nssdb to the changes happenning in NSS upstream

Fixes #307

Checklist

• Test suite updated with functionality tests
• Test suite updated with negative tests
• Rustdoc string were added or updated
• CHANGELOG and/or other documentation added or updated
• This is not a code change

Reviewer's checklist:

• Any issues marked for closing are fully addressed
• There is a test suite reasonably covering new functionality or modifications
• This feature/change has adequate documentation added
• A changelog entry is added if the change is significant
• Code conform to coding style that today cannot yet be enforced via the check style test
• Commits have short titles and sensible text
• Doc string are properly updated

[Jakuje]

I am wondering how the PQC algorithm tests worked before this with the NSS DB when the new attributes like Encapsulate, ParamSet and others could not have been stored in the database ....

[Jakuje]

Could we have a simple regression test for this to make sure this works in both db backends correctly?

[simo5]

I am wondering how the PQC algorithm tests worked before this with the NSS DB when the new attributes like Encapsulate, ParamSet and others could not have been stored in the database ....

Good q, I think they simply always use the sqlite database, we'll have to figure out how to make sure most test are also tried on nssdb, perhaps a build target that has only the nssdb ?

[Jakuje]

I am wondering how the PQC algorithm tests worked before this with the NSS DB when the new attributes like Encapsulate, ParamSet and others could not have been stored in the database ....

Good q, I think they simply always use the sqlite database, we'll have to figure out how to make sure most test are also tried on nssdb, perhaps a build target that has only the nssdb ?

Thats not how I wrote that. When nssdb is enabled, it should default to NSSDB, unless something changed since I did this:

kryoptic/src/tests/mod.rs

Line 191 in 461010b

fn get_default_db(name: &str) -> (&'static str, String) {

[simo5]

I think I changed that because at some point all CI jobs included nssdb, and that means sqlite was never tested, so I think I change something and then forgot about it.

Maybe we should open a separate issue to follow up on this?

[simo5]

Marking this as draft because I think we need to add at least a test that will upgrade a database with the new attributes and work correctly after doing that