Add SLH-DSA support for the TLS 1.3 and DTLS 1.3 handshake

Implement SLH-DSA (SPHINCS+, FIPS 205) as an entity authentication
algorithm for the TLS 1.3 and DTLS 1.3 handshake, following
draft-reddy-tls-slhdsa. All twelve parameter sets (SHAKE and SHA2 families,
128/192/256 in the f and s variants) are wired into the handshake for
signing and verifying the CertificateVerify message; test certificates and
configs cover the 128f and 128s sets.

Handshake integration:
- Map the SLH-DSA signature schemes to and from the wire in the
  signature_algorithms extension and CertificateVerify. The mapping,
  advertisement, and OID handling are gated per parameter set so a build
  only offers, accepts, and maps the variants actually compiled in
  (including partial SHA2 builds).
- Sign and verify the CertificateVerify with an SLH-DSA entity key, and
  load SLH-DSA private keys and certificates (ssl_load.c, ssl.c,
  ssl_api_pk.c, asn.c).

Streamed CertificateVerify send:
- SLH-DSA signatures are large (up to ~50 KB). When the CertificateVerify
  body exceeds a single record, generate the signature into a
  connection-level buffer and emit it one record at a time so the output
  buffer never has to hold the whole signature. This keeps peak memory near
  one signature plus a single fragment and resumes correctly across a
  non-blocking WANT_WRITE without recomputing the randomized signature.
  Gated by WOLFSSL_TLS13_STREAM_CERT_VERIFY (TLS 1.3, non-async, PQC
  signatures); DTLS and WOLFSSL_ASYNC_CRYPT keep the existing in-place
  fragmented path.
- Dual-algorithm (WOLFSSL_DUAL_ALG_CERTS, BOTH) CertificateVerify bodies are
  streamed as well. The combined two-signature body may include a
  variable-length signature, so the body buffer is sized from the
  per-signature upper bounds and the exact length is recorded after signing;
  the small trailing slack is never sent.

Buffer sizing:
- Make MAX_X509_SIZE parameter-aware for post-quantum certificates, sizing
  it from the largest enabled SLH-DSA or ML-DSA signature rather than a
  flat 8 KB that cannot hold an SLH-DSA-signed certificate.
- Size the CertificateVerify and PreTBS buffers from the actual signature
  length instead of the worst-case WC_MAX_CERT_VERIFY_SZ, which balloons
  with SLH-DSA. WC_MAX_CERT_VERIFY_SZ is retained for API compatibility.

Tests and certificates:
- Add SLH-DSA entity (client and server) certificates for the SHAKE and
  SHA2 128f and 128s parameter sets, and update the generation script.
- Add TLS 1.3 and DTLS 1.3 entity-cert CertificateVerify test configs
  covering the fragmented (128f) and single-record (128s) send paths for
  both hash families, wired into suites.c.

Author: Frauschi

certs/slhdsa/client-mldsa44-sha2.der

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMVBEBjnLskgvRwsDH46s5f5Zd6W3FlAhW+xy1sfGck
+hxcoVcIwxXOLlxrHqFE0n9/gAtpsMQCIZUs9O8FUCTLaUikI
+-----END PRIVATE KEY-----

certs/slhdsa/client-mldsa44-shake.der

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMUBEC9vheZPBjaR8CIx4Hw4qNb503pQeKv5AOVbmS7
+S7otdQcBoV5stru1r86z4CgV82aKtfJIRZ6ev7qfTphHEqg9
+-----END PRIVATE KEY-----

certs/slhdsa/client-slhdsa-sha2-128f-priv.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMbBECXSHJ0c9BqJlQbpOZD0vK429qeSsM7k8CRff2c
+8P0srigPxVobEk82k2A6ptGfGkECMFGXvfkXb99vAaZ0/gqt
+-----END PRIVATE KEY-----

certs/slhdsa/client-slhdsa-sha2-128f.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MFICAQAwCwYJYIZIAWUDBAMaBEBmQgMOIy2lyxOjyWQehHEH3uiw72tZvmnWBfs8
+qNGZ46VII9GLPrz/jVN1LvJOAhJmcVLlA5GJ9Hnf9LOOCrbY
+-----END PRIVATE KEY-----