Add MASTG-BEST files for Improper Hashing on Android and iOS

[Copilot]

This PR closes #issue_number

Description

Adds best practice guidance for secure hashing algorithms on Android (MASTG-BEST-0025) and iOS (MASTG-BEST-0026).

Coverage:

• General Hashing: Deprecates MD5/SHA-1, recommends SHA-256/SHA-512 for integrity/fingerprinting
• Password Hashing: PBKDF2 with 600,000 iterations minimum (PBKDF2WithHmacSHA256 for Android, CCKeyDerivationPBKDF for iOS)
• Message Authentication: HMAC for keyed integrity checks
• Key Derivation: HKDF restricted to high-entropy inputs only (not passwords)

Android Example (Java/Kotlin):

// Password hashing with PBKDF2
SecretKeyFactory factory = SecretKeyFactory.getInstance("PBKDF2WithHmacSHA256");
KeySpec spec = new PBEKeySpec(password.toCharArray(), salt, 600000, 256);
byte[] hash = factory.generateSecret(spec).getEncoded();

iOS Example (Swift):

// Modern approach with CryptoKit
import CryptoKit
let hash = SHA256.hash(data: data)
let authCode = HMAC<SHA256>.authenticationCode(for: message, using: key)

Both files include platform-specific code examples and references to NIST, OWASP, RFCs, and official platform documentation.

---

[x] I have read the contributing guidelines.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Create MASTG-BEST best practice files addressing "Improper Hashing" in Android and iOS</issue_title>
<issue_description>Use this as a reference, double check for technical accuracy.
Be sure to format everything well and include authoritative sources for everything.

Android

• Avoid MessageDigest algorithms such as "MD5" and "SHA1". Use "SHA-256" or "SHA-512" when hashing for integrity or fingerprinting.
• For password hashing use SecretKeyFactory with PBKDF2WithHmacSHA256 or stronger, with high iteration counts, rather than a single hash.
• Avoid rolling custom cryptographic constructions with raw hashes. Use HMAC for keyed integrity and use HKDF only for high entropy inputs.

iOS

• Prefer modern APIs such as CryptoKit for SHA256 and SHA512. Avoid MD5 and SHA1 for new designs.
• For password hashing use PBKDF2 via CommonCrypto with a strong iteration count, never raw SHA functions.
• Use HMAC for keyed integrity checks and apply HKDF only to high entropy secrets.

</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Create MASTG-BEST best practice files addressing "Improper Hashing" in Android and iOS #3519

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.