Add external-mu (extmu) support to Signature wrapper and tests

[dstebila]

Adds first-class support for the ML-DSA external-mu variants (ML-DSA-44-extmu, ML-DSA-65-extmu, ML-DSA-87-extmu) that liboqs now enables, replacing the temporary test skip from #152.

Background

externalMu is the FIPS 204 (Algorithm 7) option to supply the message representative µ from a separate cryptographic module instead of a raw message. In liboqs this was added in open-quantum-safe/liboqs#2366, following the design discussion in open-quantum-safe/liboqs#2254.

API design rationale

The liboqs design deliberately reuses the existing sign/verify API rather than introducing a dedicated function. From #2254, the maintainer's chosen approach (Option 1) is to "reuse the existing signing API and interpret the message input as mu for these variants", explicitly rejecting a new OQS_SIG_sign_with_external_mu because "externalMu is algorithm-specific" and "adding a new global API is difficult to justify." Accordingly:

• There is no dedicated external-mu C function to bind — sign()/verify() already work for extmu; the caller simply passes the externally computed µ as the "message".
• liboqs exposes no runtime µ length (it lives only in per-algorithm compile-time macros, e.g. OQS_SIG_ml_dsa_44_extmu_length_mu = 64) and enforces its own 64-byte check internally.

This PR mirrors that philosophy in the Python wrapper — keeping the signing API uniform and algorithm-agnostic instead of re-encoding a per-algorithm crypto constant:

• Add an is_extmu flag (instance attribute + details) so callers can detect external-mu variants.
• Document on sign()/verify() that for extmu variants the input is the externally computed µ.
• No new methods and no hardcoded µ length in oqs.py — length validation is left to liboqs.

Tests

• Parametrize the generic sign/verify tests to use a 64-byte message for extmu variants, mirroring liboqs's own tests/test_sig.c (which likewise hardcodes 64 in test code). This restores full correctness / wrong-message / wrong-signature / wrong-public-key coverage for the extmu variants.
• Drop the "extmu" entry from disabled_sig_patterns (the Skip extmu ML-DSA variants in generic signature tests #152 stopgap).
• Add test_is_extmu_flag.

Verified locally against a liboqs build with the extmu variants enabled.

Closes #151.

🤖 Generated with Claude Code

[dstebila]

@bhess @abhi-dev-engg Here's a PR that adds external-mu support to liboqs-python. Since you were involved in designing this for liboqs, I'd appreciate your feedback.