Add PSS_SHA256 and PSS_SHA512 to rsa_verify. They verify RSASSA-PSS
signatures (RFC 8017, section 8.1.2) with MGF1 over the digest's hash, a
salt as long as the digest, and the 0xbc trailer, as TLS 1.3 and JOSE
use. Other salt lengths and MGF1 hashes return 0. Under PSS_SHA512, a
modulus below 1034 bits returns 0: the encoding needs 130 bytes, so no
signature can verify. The length, key and signature rules are those of
the PKCS1v15 schemes.

The salt keeps the encoded message from being rebuilt and compared
whole, as it is for PKCS#1 v1.5, so verification follows the steps of
EMSA-PSS-VERIFY. The decrypted signature must be less than
2^(modBits-1), which also rejects one that does not fit when the
encoding is a byte shorter than the modulus. The PSS_SHA512 floor is
checked before the exponentiation.

PSS shares the bracket costs. Its decoding takes 0.4 to 2.0
microseconds on an AMD Ryzen 7 7840HS, at most 2% of the worst
exponentiation in each bracket, inside the 10% margin.

Tests sign with crypto/rsa under all four schemes, with new 1033, 1034
and 2049 bit keys: under 1025, 1033 and 2049 bits the encoding is a
byte shorter than the modulus, and 1034 bits is the PSS_SHA512 floor.
An encoder independent of rsa_verify's builds the rejected encodings.
Tests also run three Project Wycheproof RSASSA-PSS files, from the same
commit as the PKCS#1 v1.5 ones.

Add rsa_verify (0xe8) at AVM v14, held in the EXPERIMENTAL block with
sumhash512 until its costs are confirmed on reference hardware.

rsa_verify S takes a digest, a signature, a big-endian modulus and a
uint64 public exponent, and verifies an RSASSA-PKCS1-v1_5 signature.
Schemes are PKCS1v15_SHA256 and PKCS1v15_SHA512. The digest length, a
modulus over 512 bytes, or a signature not exactly as long as the
modulus fail the program. A modulus with a leading zero byte, under 1024
bits, or even; an exponent that is even, below 3 or above 65537; a
signature not less than the modulus; or a padding or digest mismatch
return 0.

Verification is math/big exponentiation followed by re-encoding the
expected message and comparing it whole. crypto/rsa is not used because
what it accepts depends on the Go version and on GODEBUG settings
(rsa1024min, fips140=only), which must not affect consensus.

Cost is flat per 1024-bit bracket of the modulus length, using a new
bracketCost: 1050 / 2650 / 5200 / 8250 for moduli up to 128 / 256 / 384
/ 512 bytes. Each is the worst measured time, at e = 65535, times the
rate implied by ecdsa_verify Secp256r1 (about 43 units per microsecond),
plus 10%. Worst times on an AMD Ryzen 7 7840HS with go1.25.3: 20.0,
54.3, 107.7 and 167.9 microseconds.

Tests include the Project Wycheproof 2048-bit RSASSA-PKCS1-v1_5 vectors
(Apache License 2.0) under testdata/wycheproof.