Fix NO_PKCS7_STREAM infinite loop on constructed-definite EnvelopedData

The fragmented-OCTET-STRING loop in wc_PKCS7_DecodeEnvelopedData() only
breaks on error under !NO_PKCS7_STREAM; the non-streaming build has no
error exit and relies solely on finding an indefinite EOC (00 00). A
constructed definite-length [0] whose inner OCTET STRING(s) are consumed
without an EOC terminator (e.g. a definite [0] wrapping multiple OCTET
STRINGs, or a single OCTET STRING followed by trailing bytes) leaves the
scan running past the end of the buffer: GetASNTag keeps failing, ret is
set but the loop never breaks, idx stops advancing, and it spins forever
-- a hang / denial of service on a NO_PKCS7_STREAM decoder fed a
malformed message.

Add the equivalent non-streaming error exit: after the EOC check (so a
valid indefinite message still terminates on its EOC first) break when
ret is non-zero. Streaming behavior is unchanged -- the break is guarded
by #ifdef NO_PKCS7_STREAM.

Exposed by test_wc_PKCS7_DecodeEnvelopedData_constructedDefiniteOctet:
its negative cases decode exactly these malformed shapes and hung the
NO_PKCS7_STREAM CI configs (make check timed out and was cancelled) until
this fix. The single definite-length OCTET STRING form that the decoder
now unwraps to the primitive path was already handled and is unaffected.

Author: Frauschi

wolfcrypt/src/pkcs7.c

@@ -14752,6 +14752,18 @@ int wc_PKCS7_DecodeEnvelopedData(wc_PKCS7* pkcs7, byte* in,
                             break;
                         }
                     }
+                #ifdef NO_PKCS7_STREAM
+                    /* Non-streaming has no resume path. If an error was flagged
+                     * (e.g. a definite-length constructed [0] whose OCTET
+                     * STRINGs were consumed without an indefinite EOC
+                     * terminator, so the scan ran off the end of the buffer)
+                     * stop here instead of re-reading past the end forever.
+                     * The streaming build breaks on error above; this is the
+                     * equivalent exit for the non-streaming loop. */
+                    if (ret != 0) {
+                        break;
+                    }
+                #endif
                 #ifndef NO_PKCS7_STREAM
                     pkcs7->stream->expected = MAX_OCTET_STR_SZ;
                     if ((ret = wc_PKCS7_StreamEndCase(pkcs7, &localIdx,