Fix configure.ac so --enable-mldsa=verify-only

[miyazakh]

Summary

• Fix configure.ac so --enable-mldsa=verify-only (and verify/sign/make used alone) no longer disables all ML-DSA security levels.
• Previously, these sub-options only set the operation flags (ENABLED_MLDSA_MAKE_KEY/SIGN/VERIFY) but never touched the level flags (ENABLED_MLDSA44/65/87), which are otherwise only set by yes/all/44/65/87. With no level selected, all three levels ended up disabled via WOLFSSL_NO_ML_DSA_44/65/87, tripping #error ML-DSA: All levels disabled. in wc_mldsa.h and failing the build.
• Added a post-loop default: if ML-DSA is enabled but no level (44/65/87) was explicitly requested, enable all three levels by default — consistent with how --enable-mldsa (bare yes) already behaves.

Root cause

configure.ac's ML-DSA option-parsing loop (--enable-mldsa=...) never defaulted the level flags when only an operation keyword (verify-only, verify, sign, make) was given, leaving ENABLED_MLDSA44/65/87 empty and causing every parameter set to be compiled out.

Testing

• ./configure --enable-mldsa=verify-only && make check
• ./autogen.sh && ./configure --enable-mldsa=verify-only && make completes successfully (previously failed with #error ML-DSA: All levels disabled.)
• ./wolfcrypt/test/testwolfcrypt passes, including the ML-DSA test
• Verified --enable-mldsa=verify, --enable-mldsa=sign, --enable-mldsa=make (each used alone) also configure/build correctly with the fix
• Verified --enable-mldsa (bare, default yes) is unaffected and still enables all levels
• Confirmed resulting options.h macros match the intended verify-only configuration (WOLFSSL_MLDSA_VERIFY_ONLY, WOLFSSL_MLDSA_NO_MAKE_KEY, WOLFSSL_MLDSA_NO_SIGN, all three levels enabled)

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Pull request overview

This PR updates the ML-DSA (--enable-mldsa=...) option parsing in configure.ac to ensure that operation-only sub-options (e.g., verify-only, verify, sign, make) don’t accidentally result in all ML-DSA security levels being disabled, which previously caused build failures (#error ML-DSA: All levels disabled.).

Changes:

• Adds a post-parse default that enables all ML-DSA levels (44/65/87) when ML-DSA is enabled but no level was explicitly selected.
• Preserves existing behavior when levels are explicitly provided (e.g., 44, 65, 87) or when --enable-mldsa is used as yes/bare.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753

[miyazakh]

retest this please