fix(crypto): validate JWK extractability

[dills122]

Issue # (if available)

Related to #968.

Description of changes

Reject JWK imports when ext is false but the caller requests an extractable key.

The shared JWK import path previously did not enforce this WebCrypto constraint, allowing importKey() or unwrapKey() to create an extractable key from material explicitly marked non-extractable. The shared path now rejects that contradiction with a DataError for both operations while preserving successful import and unwrap when extractable is false.

This change is intentionally limited to the ext/extractable contradiction; validation of alg, key_ops, use, and other JWK metadata remains out of scope.

Relevant standards:

• Web Cryptography Level 2 — SubtleCrypto.importKey()
• Web Cryptography Level 2 — algorithm-specific JWK import requirements

Validation:

• cargo test -p llrt_crypto --all-targets — 23 passed
• focused LLRT crypto.subtle runtime suite — 18 passed
• cargo clippy -p llrt_crypto --all-targets -- -D warnings
• cargo fmt --all -- --check
• Prettier check for tests/unit/crypto.subtle.test.ts
• git diff --check
• complete fork CI matrix passed

Checklist

• Created focused unit coverage for direct import and unwrap behavior
• Ran targeted Rust and TypeScript formatting checks
• Made sure the code adds no warnings with warning-denied Clippy and the CI check job
• Confirmed type changes are not applicable
• Confirmed documentation changes are not required

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[richarddd]

Nice! Thank you!