feat(security): enforce export part hash verification

[smekcio]

Summary

• enforce SHA-256 verification for encrypted export parts using x-ms-meta-hash
• add configurable requirement for export part hash presence
• fail fast on hash mismatch

Changes

• Added KsefClientOptions.require_export_part_hash (default: True)
• Updated sync/async export workflows to validate part hashes before decryption
• Added tests for matching hash, missing hash (required/optional), mismatch (sync + async)
• Updated docs (configuration, workflows/export)

Validation

• python -m pytest -q
• Result at submission time: 404 passed, 4 skipped