chore(node_compat): ignore 3 crypto tests gated on missing WebCrypto algorithms

[lunadogbot]

Summary

Marks three more failing crypto tests as ignored in tests/node_compat/config.jsonc. All three depend on WebCrypto algorithms / Level 2 APIs Deno doesn't implement. Failure outputs come from the 2026-04-26 node compat run; pure-config-change ignores so I did not rebuild Deno locally to re-confirm.

parallel/test-webcrypto-digest.js

NotSupportedError: Unrecognized algorithm name
  new Uint8Array(await subtle.digest({ name: 'cSHAKE128', length: ... }, ...))

cSHAKE (Customizable SHAKE per NIST SP 800-185) is a Node-specific WebCrypto extension that requires OpenSSL >= 3 for the customization-string wrapper. Deno's ext/crypto/ only exposes the underlying SHAKE128 / SHAKE256 via crypto.createHash(). Could be revisited if a SHA3-based cSHAKE implementation lands -- the existing sha3 / cshake Rust crates would cover the customization-string path.

parallel/test-webcrypto-get-public-key.mjs

TypeError: subtle.getPublicKey is not a function
  const publicKey = await subtle.getPublicKey(privateKey, usages);

The WebCrypto Level 2 method that derives a public CryptoKey from a private one. Deno does not implement it. Implementable on top of Deno's existing per-algorithm export/import paths, but would need to handle every supported algorithm (ECDH, ECDSA, Ed25519, RSA-OAEP, RSA-PSS, RSASSA-PKCS1-v1_5, X25519). Could be revisited as a discrete WebCrypto Level 2 add-on -- same surface that the already-ignored test-webcrypto-supports.mjs advertises.

parallel/test-webcrypto-sign-verify.js

NotSupportedError: Unrecognized algorithm name
  const key = await subtle.generateKey({
                       ^

After the RSASSA-PKCS1-v1_5 / RSA-PSS / ECDSA / HMAC blocks pass and Ed448 self-skips, the test continues into a hasOpenSSL(3)-gated KMAC128 / KMAC256 sign/verify block. Same blocker family as the already-ignored test-webcrypto-keygen-kmac.js and test-webcrypto-sign-verify-kmac.js. Could be revisited if KMAC is added.

Test plan

• JSONC parses (Deno.readTextFileSync + @std/jsonc); all three new entries readable as {ignore: true, reason: ...}.
• CI: green on node_compat_tests with the three tests now skipped.

[fibibot]

LGTM. Pure config-additions, all three positioned correctly:

• test-webcrypto-digest.js between derivebits-argon2 and encap-decap-ml-kem.
• test-webcrypto-get-public-key.mjs between export-import-ml-kem and getRandomValues.
• test-webcrypto-sign-verify.js between sign-verify-ml-dsa and util.

Each reason identifies a distinct underlying gap and cross-references the sibling test where applicable:

• cSHAKE128/cSHAKE256 for digest — NIST SP 800-185 customizable SHAKE variants Deno doesn't register; reason points at the implementation path (cshake-rs or sha3+cshake wrapper).
• subtle.getPublicKey(privateKey, usages) is a WebCrypto Level 2 method Deno doesn't implement; reason correctly enumerates the algorithms it'd need to cover.
• KMAC128/256 in sign-verify.js — same family as the already-ignored test-webcrypto-keygen-kmac.js and test-webcrypto-sign-verify-kmac.js; reason notes the test fails before reaching the Ed25519 cases.

CI green.