feat: add vault WASM crypto functions

[skgbafa]

Summary

• Add WASM vault crypto functions: AES-256-GCM encrypt/decrypt, HKDF-SHA256 key derivation, X25519 keypair generation and DH
• Sanitize public endpoint metadata headers (only expose content-type, content-encoding, content-language)
• Use Metadata directly instead of ObjectHeaders responder for public routes

Changesets

• sdk: minor (new vault WASM module)
• core: patch (public endpoint header sanitization)

Test plan

• WASM build succeeds with new vault module
• Public endpoint returns only sanitized headers
• Existing public KV read/head endpoints still work