Payment Cryptography: add full control plane support

[jerryhxu]

Summary

This PR adds Moto support for all 32 AWS Payment Cryptography control-plane operations.
The implementation provides a complete control-plane foundation for testing infrastructure-management tools such as Cloud Custodian.

What’s included

• Key creation, retrieval, listing, deletion, restoration, and usage state
• Alias creation, retrieval, listing, updating, and deletion
• Resource tagging and untagging
• Resource policy management
• Default and per-key multi-Region replication
• Import and export parameters and stateful mock round trips
• Public-key certificates and certificate signing requests
• MPA team association lifecycle
• Pagination and common validation errors
• Moto server-mode routing
• Service documentation listing all supported operations

The implementation also includes:

• Algorithm-appropriate key material and key-check-value calculation
• Import and export token validation
• Preservation of key attributes and material across mock export/import workflows
• Requested RSA key sizes and CSR signing hashes
• Lifecycle propagation between primary and replica keys
• Persistent MPA deletion state

Scope and limitations

This PR targets stateful control-plane mocking and does not add Payment Cryptography Data Plane operations.

Import and export behavior supports coherent Moto-generated workflows, but it does not provide wire-compatible TR-31/TR-34 processing, emulate AWS HSM cryptography, or claim exact AWS behavioral parity for every validation edge case.

Testing

• pytest -q tests/test_paymentcryptography
• make lint
• Moto server-mode dispatch

All 32 boto3 control-plane operations are checked for both backend and response-layer implementations.