crypto: avoid throwing key brand checks

[panva]

Use the native KeyObject and CryptoKey FunctionTemplate brand check instead of probing slot access and catching ERR_INVALID_THIS. Keep a private-field fast path for ordinary same-realm keys.

Before this change isKeyObject() and isCryptoKey() detected invalid objects by calling their slot getters, catching ERR_INVALID_THIS, and returning false. Because node:crypto APIs check key inputs for being key objects first this change has a positive downstream effect on every use of those APIs that isn't with a key object (e.g. PEM, DER, JWK, etc) as well as on use with key object embedded in an regular object as { key: KeyObject, ...options }

Operation	Before	After	Change
createHmac() with a Buffer key	167k ops/s	622k ops/s	+272%
createCipheriv() with a Buffer key	148k ops/s	594k ops/s	+301%
hkdfSync() with a Buffer key	91.7k ops/s	171.6k ops/s	+87%
createPublicKey() with DER options	44.8k ops/s	76.2k ops/s	+70%
createPrivateKey() with DER options	29.8k ops/s	41.9k ops/s	+41%
sign() with DER options	17.8k ops/s	21.9k ops/s	+23%
verify() with DER options	13.4k ops/s	15.1k ops/s	+13%
publicEncrypt() with options and a Buffer	22.6k ops/s	29.2k ops/s	+29%
diffieHellman() with two Buffer keys	13.6k ops/s	15.5k ops/s	+14%
encapsulate() / decapsulate() with a Buffer key	15.8k ops/s	17.3k ops/s	+9.5%

Object-form key inputs benefit more because both the options object and its key payload previously caused failed brand checks.

SubtleCrypto operations are unaffected because they use WebIDL interface conversion instead of isCryptoKey().

[nodejs-github-bot]

Review requested:

• @nodejs/crypto

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76316/

[codecov]

Codecov Report

❌ Patch coverage is 92.85714% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.13%. Comparing base (7d69ed1) to head (3d5397c).
⚠️ Report is 27 commits behind head on main.

Files with missing lines	Patch %	Lines
src/crypto/crypto_keys.cc	87.50%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #65503      +/-   ##
==========================================
- Coverage   90.14%   90.13%   -0.02%     
==========================================
  Files         751      751              
  Lines      252521   252701     +180     
  Branches    47511    47552      +41     
==========================================
+ Hits       227635   227771     +136     
- Misses      16192    16210      +18     
- Partials     8694     8720      +26     

Files with missing lines	Coverage Δ
lib/internal/crypto/keys.js	98.02% <100.00%> (-0.02%)	⬇️
src/crypto/crypto_keys.h	62.22% <ø> (ø)
src/crypto/crypto_keys.cc	69.84% <87.50%> (+0.19%)	⬆️

... and 38 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.