Implement deterministic ECDSA sign (RFC6979)

[seblu]

Description:

When using ldns-signzone to sign zones with ECDSA, the resulting NSEC3 records and signatures are not stable. Signing the same zone multiple times produces different signed zones, even when the input zone remains unchanged.

The current non-deterministic behavior complicates scenarios where consistent signed zones are required for reproducibility, testing, or version control.

Technical Context:

RFC 8624 recommends using deterministic digital signature generation for ECDSA to address such issues:

It is RECOMMENDED to use the deterministic digital signature generation procedure of the Elliptic Curve Digital Signature Algorithm (ECDSA), specified in [RFC6979], when implementing ECDSAP256SHA256 (and ECDSAP384SHA384).

Deterministic ECDSA signatures eliminate randomness by deriving the per-signature value ( k ) deterministically from the private key and input data. This ensures consistent signatures for identical inputs, resolving the instability in signed zones.

OpenSSL introduced support for RFC 6979 deterministic ECDSA signatures in version 3.2.0 (released at the end of 2023):
Commit: Deterministic ECDSA Signatures

This enhancement provides a foundation for implementing deterministic ECDSA signatures in ldns.