Use the generated session key when encoding the V1 SecurityKey descriptor

[gijzelaerr]

Problem

During V1 SessionKey setup, _setup_session() calls _encode_security_key_struct(blob) before assigning the newly generated session_key to self._session_key.

The encoder derives SecurityKey.SymmetricKey.KeyId from self._session_key or bytes(24), so the wire structure currently contains an ID derived from 24 zero bytes rather than from the generated session key.

The maintained .NET implementation derives this descriptor directly from the new session key.

Scope

• Pass the generated session key explicitly into the SecurityKey encoder.
• Derive the symmetric KeyId exclusively from that argument.
• Remove the zero-key fallback for authenticated setup.
• Add a deterministic structure-level regression test using the existing HarpoS7 vectors.

Acceptance criteria

• The encoded public-key ID matches the selected public key.
• The encoded symmetric-key ID matches the newly generated session key.
• The test would fail against the current all-zero-key behavior.
• Missing key material raises a clear error instead of producing a plausible malformed descriptor.
• Existing authentication-vector tests remain unchanged.

References

• Umbrella hardware issue: S7-1200 Session Setup Incomplete #710
• Authentication maintainability: Improve maintainability and auditability of S7CommPlus V1 SessionKey code #828