noise: hybrid X25519+ML-KEM-768 handshake, negotiated alongside /noise

Adds an additive, off-by-default 'mlkem-hfs' feature advertising
Noise_XXhfs_25519+ML-KEM-768_ChaChaPoly_SHA256 under a new protocol id,
falling back to classical /noise for older peers. Ports the crate to
snow 0.10 (patched to our fork carrying the ML-KEM KEM) and widens the
handshake scratch buffer for the KEM material.

Author: royzah

Cargo.lock

@@ -159,6 +159,10 @@ web-time = "1.1.0"
 
 [patch.crates-io]
 
+# Point snow at the fork carrying ML-KEM-768 for the HFS extension, until it
+# lands upstream (mcginty/snow).
+snow = { git = "https://github.com/royzah/snow", branch = "feat/ml-kem-hfs" }
+
 # Patch away `libp2p-identity` in our dependency tree with the workspace version.
 # `libp2p-identity` is a leaf dependency and used within `rust-multiaddr` which is **not** part of the workspace.
 # As a result, we cannot just reference the workspace version in our crates because the types would mismatch with what

Cargo.toml

@@ -1,5 +1,9 @@
 ## 0.47.0
 
+- Add an additive, off-by-default `mlkem-hfs` feature: a hybrid post-quantum
+  handshake (`Noise_XXhfs_25519+ML-KEM-768_ChaChaPoly_SHA256`) negotiated
+  alongside `/noise`, falling back to classical X25519 for older peers.
+
 - Raise MSRV to 1.88.0.
   See [PR 6273](https://github.com/libp2p/rust-libp2p/pull/6273).