Add export_keying_material

[jesup]

Needed for WebTransport, was previously part of the neqo PR which was already r+'d

[codecov-commenter]

Codecov Report

❌ Patch coverage is 83.33333% with 3 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@7cc1c33). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
src/agent.rs	83.33%	0 Missing and 3 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #41   +/-   ##
=======================================
  Coverage        ?   67.95%           
=======================================
  Files           ?       25           
  Lines           ?     3074           
  Branches        ?     3074           
=======================================
  Hits            ?     2089           
  Misses          ?      797           
  Partials        ?      188           

Flag	Coverage Δ
freebsd	67.95% <83.33%> (?)
linux	67.95% <83.33%> (?)
macos	67.95% <83.33%> (?)
windows	67.95% <83.33%> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Adds support for exporting TLS 1.3 keying material (RFC 8446 §7.5) to unblock WebTransport usage, with corresponding NSS binding exposure and tests.

Changes:

• Expose SSL_ExportKeyingMaterial via generated bindings.
• Add SecretAgent::export_keying_material() wrapper that returns exported bytes after handshake completion.
• Add tests validating exporter behavior (length, label/context variation, client/server consistency, invalid state).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
tests/agent.rs	Adds exporter-focused integration tests and a small connected client/server helper.
src/err.rs	Introduces Error::InvalidState for invalid operation state handling.
src/agent.rs	Implements export_keying_material() using NSS SSL_ExportKeyingMaterial.
bindings/bindings.toml	Adds SSL_ExportKeyingMaterial to the bindgen allowlist.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[martinthomson]

You'll need to appease the format gods for this to land, but it looks good to me.