crypto: prevent Hmac.digest() from returning uninitialized memory after stream use

[mcollina]

Hmac.prototype._flush was aliased to Hash.prototype._flush, which finalizes the native HMAC context but never sets the JavaScript-side kFinalized flag. After an Hmac has been used as a stream, a subsequent Hmac.prototype.digest() call therefore still believes the object has not been finalized and calls into C++ a second time. On that second call the native context has already been reset, so the digest buffer is never written and Digest::MAX_SIZE bytes of uninitialized stack memory are returned to JavaScript.

Hash is not affected because Hash::HashDigest caches its digest (refs #28245); Hmac never received the equivalent protection.

This gives Hmac its own _flush that sets kFinalized, so repeat digest() calls after stream use are handled by the existing DEP0206 guard. As defense in depth, it also sets buf.len = 0 on the native side when the context has already been reset, so unwritten bytes can never be emitted. A regression test covers the stream-then-digest() path.

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 90.31%. Comparing base (e6a8d06) to head (e410836).
⚠️ Report is 657 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_hmac.cc	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65112      +/-   ##
==========================================
- Coverage   92.01%   90.31%   -1.71%     
==========================================
  Files         379      759     +380     
  Lines      166972   248295   +81323     
  Branches    25554    46859   +21305     
==========================================
+ Hits       153639   224236   +70597     
- Misses      13041    15450    +2409     
- Partials      292     8609    +8317     

Files with missing lines	Coverage Δ
lib/internal/crypto/hash.js	98.16% <100.00%> (-0.87%)	⬇️
src/crypto/crypto_hmac.cc	68.71% <50.00%> (ø)

... and 597 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.