ci: add FFI memory-safety test lane

[HamdaanAliQuatil]

Closes #278

This adds a focused memory-safety workload for the native FFI path and runs it under Valgrind on Linux CI.

The implementation is split into:

• test/ffi/valgrind_test.dart: a VM-only test that skips outside Linux or when Valgrind is unavailable, then launches
  the standalone target under Valgrind.
• test/ffi/valgrind_target.dart: a standalone Dart program without package:test, keeping the monitored process
  focused on native crypto operations and memory pressure.

What this covers:

• AES-GCM, HMAC, ECDH, and RSA-OAEP operations through the public API.
• Key export/import ownership paths for raw, JWK, PKCS8, and SPKI formats.
• Failed native imports followed by valid operations, exercising cleanup-after-error paths.
• Repeated short-lived allocations between native operations to put pressure on Dart object lifetimes and finalizers.

The CI job uses the normal dart test path because it supports native build hooks today. Sanitizer support for hook-
built code remains blocked upstream, so this starts with Valgrind Memcheck.

Valgrind reports definite and possible leaks but only fails on definite leaks. Possible leaks can include Dart VM
runtime noise, so they remain visible without making the initial CI lane unnecessarily brittle.

[jonasfj]

I think we should consider avoiding the extra GitHub actions job if not strictly necessary