Hardening for FIPS RNG, AES-CMAC key wipe, SHA finals

[cconlon]

This PR fixes 3 Fenrir issues:

• F-8212: validate bufSz against buffer capacity in the FIPS RNG GenerateBlock wrappers
• F-8213: zeroize the previous AesCmac key clone on re-key
• F-10000: reject undersized output arrays in the SHA byte-array native finals, guard the debug hash logging

[Copilot]

Pull request overview

This PR hardens wolfcrypt-jni’s FIPS/JNI boundary checks and key-handling hygiene to address three reported issues: validating RNG output sizing, ensuring AES-CMAC key material is wiped on re-key, and rejecting undersized output buffers in SHA/SHA3 native final functions (with safer debug logging).

Changes:

• Add FIPS RNG GenerateBlock guardrails to reject negative sizes and sizes exceeding the backing ByteBuffer/byte[] capacity, plus new JUnit coverage for these cases.
• Ensure AesCmac.setKey() zeroizes the previous stored key clone before replacing it, and add a regression test that verifies the prior clone is wiped on re-key.
• Add output-array size validation to SHA/SHA224/SHA256/SHA384/SHA512 and SHA3 byte-array finals, and only emit debug hex logs when the final succeeds.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/test/java/com/wolfssl/wolfcrypt/test/fips/RngFipsTest.java	Adds tests covering rejected bufSz values for FIPS RNG GenerateBlock wrappers.
src/test/java/com/wolfssl/wolfcrypt/test/AesCmacTest.java	Adds a regression test validating prior key-clone zeroization on AES-CMAC re-key.
src/main/java/com/wolfssl/wolfcrypt/AesCmac.java	Zeroizes the previously stored key clone during setKey() before storing the new clone.
jni/jni_sha.c	Rejects undersized output arrays in SHA/SHA3 finals and guards debug hex logging on success.
jni/jni_fips.c	Validates bufSz against backing buffer capacity/length in FIPS RNG GenerateBlock JNI wrappers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.