fix GCM tls iv length check and aead tag length validation

[gasbytes]

Fixes the gcm tls fixed-iv length check to properly reject oversized inputs and adds tag length validation against each algorithm's allowed sizes for GCM and CCM, in particular this last one was wrapped in a new function called wp_aead_tag_len_valid.

[Copilot]

Pull request overview

This PR tightens AES-GCM/TLS fixed-IV handling and AEAD tag-length validation in wp_aes_aead.c, and adds unit tests to prevent regressions around oversized fixed-IV inputs and undersized authentication tags.

Changes:

• Add wp_aead_tag_len_valid() and enforce algorithm-specific allowed tag sizes for GCM and CCM when setting OSSL_CIPHER_PARAM_AEAD_TAG.
• Fix AES-GCM TLS fixed-IV length validation to reject oversized fixed-IV lengths (including those exceeding the configured IV length).
• Add new unit tests covering oversized GCM TLS fixed-IV inputs and undersized tag-length rejection for both GCM and CCM.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
test/unit.h	Declares new GCM/CCM regression tests.
test/unit.c	Registers the new tests in the unit test suite.
test/test_aestag.c	Implements new test cases for oversized TLS fixed-IV and undersized tag length rejection.
src/wp_aes_aead.c	Adds tag-length validation helper and tightens GCM TLS fixed-IV length checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.