fix(hmac): reject empty imported keys

[harrshita123]

Summary

Native HMAC imports currently accept empty key material, while browser implementations reject the same input. This creates inconsistent behavior depending on which backend an application uses.

This change validates the key data in the shared native HMAC import path and rejects empty keys before constructing the native key object. Because raw and JWK imports use the same path, the fix covers both formats without duplicating validation logic.

What changed

• Reject empty native HMAC key material with a FormatException.
• Add regression coverage for:
  • empty raw HMAC keys
  • JWK HMAC keys with an empty k value

Why this matters

An HMAC key must contain key material. Accepting an empty key can hide invalid input and cause code to behave differently between native and browser environments. Rejecting it during import makes the behavior predictable and fails early with a clear error.

Validation

• dart format --output none --set-exit-if-changed .
• dart analyze --fatal-warnings .
• Full VM test suite
• Full Chrome test suite using Dart2JS
• Full Chrome test suite using Dart2Wasm

Fixes #363

[jonasfj]

Let avoid checks on the exception message, we want this to run on web too right?

[harrshita123]

Let avoid checks on the exception message, we want this to run on web too right?

I removed the assertion on the exception message, so the test now only verifies that a FormatException is thrown. This should keep the regression consistent across native and browser implementations.