Add SPDM 1.4 ML-KEM post-quantum key exchange (FIPS 203)

[aidangarske]

Adds standalone ML-KEM key exchange (DSP0274 1.4.0, FIPS 203) to the requester — the final post-quantum piece from issue #10, completing a fully post-quantum SPDM handshake (ML-KEM key exchange + ML-DSA signing).

Spec grounding (DSP0274 1.4.0)

Authoritative facts from the 1.4.0 text — ML-KEM is standalone, not hybrid (section 23.5: "No support for hybrid algorithms"). The requester sends the encapsulation key ek in KEY_EXCHANGE; the responder returns ciphertext c; the requester decapsulates to a 32-byte K' that feeds the existing key schedule in place of the ECDH secret. KEMAlg AlgStruct = AlgType 0x07; ML-KEM-512/768/1024 = 0x01/0x02/0x04 (cross-checked vs libspdm 3.8).

What's here

• --enable-mlkem gate (auto from WOLFSSL_HAVE_MLKEM), wc_MlKemKey_* API only.
• KEMAlg negotiation, dual-stack with DHE; parse enforces exactly one of DHE/KEM.
• KEY_EXCHANGE sends ek; KEY_EXCHANGE_RSP decapsulates c to K'; zero new allocation; ephemeral key union with ecc_key.
• Runtime wolfSPDM_SetKeyExchangePref + demo --kex ecdhe|mlkem512|mlkem768|mlkem1024.

Testing

• Unit: ML-KEM decapsulation K==K' round trip, KEM negotiation offsets, DHE-xor-KEM mutual exclusivity. Passes across mldsa+mlkem / classical / mlkem-only / mldsa-only; strict -Werror -Wconversion -Wshadow clean; no bare scopes; no wc_kyber tokens.
• CI interop (spdm-emu, OpenSSL backend): ML-KEM-512/768/1024 (isolated, ECDSA sig) + full-PQ leg (ML-KEM-768 + ML-DSA-65/87; the -87 case also exercises chunking).