Pkcs7 enforce gcm/ccm tag length

[kaleb-himes]

Description

PKCS7 AuthEnvelopedData decoding now enforces the ICV sizes RFC 5084 actually permits: 12 to 16 bytes for AES-GCM (section 3.2), and even sizes of 8 bytes or more for AES-CCM (section 3.1 plus the SP 800-38C Appendix B.2 floor), so a bundle cannot dictate a shorter tag than the standard allows even in builds that relax WOLFSSL_MIN_AUTH_TAG_SZ. It also restores the cipher OID when the streaming decoder re-enters at the tag state, without which the size check was silently skipped on chunked input.

Followup of the fixes for zd#22449 (#11478)

Testing

How it was tested

• Three new tests craft bundles with truncated tags and confirm rejection at 8 bytes (GCM) and 6 bytes (CCM), odd-size rejection for CCM, and acceptance at the RFC-legal 12 and 13 for GCM.
• Every check was proven by negative control: with the floors zeroed, or with the stream-re-entry restore deleted, the corresponding test fails (the latter returning BAD_FUNC_ARG instead of ASN_PARSE_E), and passes once restored.
• Verified across default streaming, NO_PKCS7_STREAM, and WOLFSSL_MIN_AUTH_TAG_SZ=4 (the kernel-module setting, where the pre-existing minimum can no longer mask the new floors) — 0 failed in each, testwolfcrypt clean.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753