Add TPM MLDSA authentication for post quantum TLS 1.3 with example and tests

[aidangarske]

Description

• Wires ML‑DSA signing into wolfTPM2_CryptoDevCb so a TLS 1.3 server signs CertificateVerify on the TPM the device identity key never leaves the chip;
  ML‑KEM key exchange runs in wolfSSL.
• New example trio: gen_pqc_certs (software ML‑DSA CA + TPM‑keyed device leaf cert), tls_server_pq (TPM‑backed ML‑DSA identity via use_PrivateKey_Id),
  tls_client_pq (ML‑KEM key exchange, CA‑verified). CLI‑selectable ML‑DSA set (44/65/87) and ML‑KEM group (512/768/1024 + hybrid SECP256R1MLKEM768 /
  X25519MLKEM768).
• Runs against the in‑tree fwTPM (no shipping TPM implements TCG v1.85 PQC yet); ready to run unchanged on PQC‑capable silicon.
• Requires a wolfSSL fix routing wc_MlDsaKey_SignCtx to the crypto callback for device keys a separate wolfSSL PR follows; this is its reference.
• Unit test covers the crypto‑cb ML‑DSA sign path (fallbacks, TPM happy path, signature+context verify, BUFFER_E size contract, NULL‑arg guards);
  tests/tls_pq_e2e.sh drives the full PQC handshake end‑to‑end across the group/param matrix.
• Fully feature‑guarded (WOLFTPM_MLDSA_SIGN, WOLFTPM_CRYPTOCB, WOLF_PRIVATE_KEY_ID, WOLFSSL_TLS13, sign‑only via WOLFTPM_MLDSA_VERIFY, cert‑gen keygen/sign
  via WOLFSSL_MLDSA_NO_MAKE_KEY/_NO_SIGN); e2e gated on BUILD_SWTPM_TCP.
• Added example to CI
• reroute CI to wolfssl master after 10979 merge
  needs Route wc_MlDsaKey_SignCtx through the crypto callback before the prvKeySet check for device keys wolfssl#10979

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.