Implements the client side of AT Protocol's permissioned data protocol
(proposal 0016), the second data protocol alongside public broadcast:
the same shape — DID-based authority, per-user repos, Lexicon-typed
records, applications crawling hosts — with an access perimeter around
it, called a space.

Protocol machinery under `Spaces/`:

- `SpaceUri` / `SpaceRecordUri` for the `at://.../space/...` grammar,
  where the URI's authority is the space authority that gates access
  while the record's authority remains its author.
- `LtHash`, the homomorphic set hash a permissioned repo commits to in
  place of an MST root, on a from-scratch BLAKE3 XOF implementation
  (.NET ships none, and the SDK carries no third-party crypto).
- `SpaceRepoCommit` / `SpaceCommitVerifier`: the signature covers only
  the context, never the digest, which is bound by a symmetric MAC — so
  a leaked commit is deniable and proves nothing about its contents.
- `SpaceRepoCar` for the two-root CAR, whose layout lets a consumer
  authenticate the whole index against the commit without reading a
  single record.
- `SpaceCredentialProvider` / `SpaceReader` for the DPoP-bound
  credential exchange, and `SpaceSyncer` for incremental sync with
  automatic full-state recovery on a digest mismatch.

Endpoints on `AtProtoClient.Space` (`com.atproto.space.*`) and
`AtProtoClient.SimpleSpace` (`com.atproto.simplespace.*`), plus
`AtProtoScopes.Space(...)` for `space:` OAuth scopes.

Also fixes two pre-existing bugs the feature depends on: DAG-CBOR map
keys were sorted bytewise rather than length-first, so every CID the SDK
computed for a record whose keys spanned more than one length disagreed
with the rest of the network; and DPoP proofs named the full request URL
in `htu` where RFC 9449 requires query and fragment stripped.

The LtHash digests, commit context encoding, and MAC are pinned against
values generated by the reference implementation's own libraries, the
BLAKE3 vectors come from the reference implementation, and the DAG-CBOR
ordering fix is pinned against a post fetched from a live PDS alongside
the CID that PDS reported for it.

closes #89

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

@@ -152,0 +311,4 @@
+        if (collections is not null)
+        {
+            foreach (var collection in NormalizeCollections(collections))
+                AppendParam(sb, ref hasParams, "collection", collection);