feat(sdk): add opt-in hexless policy binding

[pflynn-virtru]

Summary

Adds an opt-in hexless policy binding: each key access object's policy binding hash is written as Base64(HMAC), the form the TDF spec defines, instead of the legacy Base64(hex(HMAC)). Default output is unchanged. Mirrors opentdf/platform#4232 (Go).

• Config.withHexlessPolicyBinding() and the cmdline flag --hexless-policy-binding.
• A pre-4.3.0 Config.withTargetMode overrides the opt-in and keeps the legacy form, whatever the option order.
• Reader: when a binding decodes to 32 bytes, the rewrap request carries a copy of the key access object with the binding re-encoded as Base64(hex(HMAC)). Both forms carry the same HMAC, and every KAS verifies the legacy form, so this SDK can decrypt hexless TDFs against any KAS. Legacy bindings pass through unchanged, and the manifest itself is never modified. Older readers forward the binding unchanged and need a KAS with fix(kas): accept spec-compliant policy bindings platform#4223.
• Known-answer vectors are shared with the Go SDK.

Part of opentdf/platform#3578.

Testing

• mvn -pl sdk,cmdline -am test: sdk 315, sdk-pqc-bc 28, cmdline 14, all passing.
• New tests: PolicyBindingTest (known answers for both forms; re-encode only for 32-byte bindings; null and bare-string handling), TDFTest.hexlessPolicyBindingOnEveryKeyAccess (two-KAS split), TDFTest.legacyTargetModeOverridesHexlessPolicyBinding (both orders), TDFTest.rewrapRequestCarriesLegacyBinding, ConfigTest, CommandTest.encrypt_hexlessPolicyBindingFlag_acceptedByPicocli.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
88.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

X-Test Failure Report

✅ js@main-main
✅ java@v0.19.1-v0.29.0
✅ go@main-main
✅ js@main-v0.29.0
✅ java@v0.19.1-main
✅ go@main-v0.29.0
✅ java@pull-421-main
server-logs-java@pull-421-v0.29.0