SHA3-10 Security, zeroization, and API misuse docs

[turkananation]

SHA3-10 Security, Zeroization, and API Misuse Docs

Summary

Document SHA-3/SP 800-185 security boundaries, zeroization limits, KMAC misuse
guidance, and claim wording.

Scope

• Add KMAC key length guidance.
• Add KMAC output/tag length guidance.
• Document byte-only public API limitations if applicable.
• Document no hard constant-time or hard memory-erasure guarantee for Dart.
• Update SECURITY_AUDIT.md, FIPS_COMPLIANCE.md, and README wording.

Acceptance criteria

• Public docs distinguish algorithm/vector evidence from CMVP/FIPS 140.
• KMAC is not described as HMAC.
• TupleHash and ParallelHash use cases are documented without overclaiming.

References

• doc/FIPS202_SP800185_RELEASE_GUIDE.md - Security and Side-Channel Posture
• doc/FIPS_140_BOUNDARY.md
• SP 800-185 Section 8

Priority: P1