Integrate Wycheproof ML-KEM test vectors

[sgmenda]

Description of changes:

Integrates 9 Wycheproof ML-KEM test vector files:

• 3 ML-KEM encapsulation test files (mlkem_512_encaps_test, mlkem_768_encaps_test, mlkem_1024_encaps_test)
• 3 ML-KEM test files (mlkem_512_test, mlkem_768_test, mlkem_1024_test)
• 3 ML-KEM decapsulation test files (mlkem_512_semi_expanded_decaps_test, mlkem_768_semi_expanded_decaps_test, mlkem_1024_semi_expanded_decaps_test)

Each integration adds upstream JSON vectors and converted txt files to third_party/vectors/, and adds test code with duvet annotations for traceability.

Call-outs:

• Generated new test vectors: the ML-KEM decapsulation test vectors (mlkem_[512/768/1024]thu_semi_expanded_decaps_test) are new, and have been merged into upstream Add ML-KEM decapsulation validation test vectors C2SP/wycheproof#202. Adds util/vecgen that we used to generate the test vectors.
• Missing encaps key import checks: we successfully import ML-KEM encapsulation keys with modulus overflow. This is allowed by FIPS 203, but is not ideal, so the tests print a warning. We will resolve this in an upcoming PR.
• Missing decaps key import checks: we successfully import ML-KEM decapsulation keys with an inconsistent hash of the embedded encaps key. This is also allowed by FIPS 203, so the tests print a warning, and we will resolve this in an upcoming PR.

Testing:

All new tests pass and duvet verification succeeds:

cd build && ./crypto/crypto_test --gtest_filter="*Wycheproof*"
cd third_party/vectors && python3 sync.py

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 87.80488% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 78.22%. Comparing base (8238483) to head (9bdbb4c).

Files with missing lines	Patch %	Lines
crypto/test/wycheproof_util.cc	22.22%	7 Missing ⚠️
crypto/evp_extra/p_kem_test.cc	95.89%	3 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2891   +/-   ##
=======================================
  Coverage   78.22%   78.22%           
=======================================
  Files         690      690           
  Lines      118745   118827   +82     
  Branches    16680    16681    +1     
=======================================
+ Hits        92884    92954   +70     
- Misses      24972    24984   +12     
  Partials      889      889           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sgmenda]

I added some noseed decaps test vectors to see how we handle invalid decaps keys, and similarly to encaps, we successfully import invalid decaps keys, but do not successfully decaps with them. This also seems not-ideal.

[dkostic]

Great work, thanks for doing this!