Add LMS Support

[aidangarske]

• Adds OpenSSL 3.6 compatible LMS verification support.
• Imports and exports raw XDR LMS public keys.
• Supports the OpenSSL message verification API.
• Enforces wolfSSL 5.9.2 and required LMS parameter families.
• Adds LMS unit, decoder, interoperability, and negative-path coverage.
• Runs all 320 OpenSSL LMS KAT vectors in PQC CI.
• Separates LMS and non-LMS dependency caches.
• Rejects LMS FIPS builds until CAST integration is available.
• Full Linux wolfProvider suite passed with OpenSSL 3.6.3 and wolfSSL 5.9.2-stable.
• Combined ML-KEM, ML-DSA, and LMS KAT passed all 2,922 sub-tests.

[Copilot]

Pull request overview

This PR adds verification-only LMS (RFC 8554 / NIST SP 800-208) support to wolfProvider for OpenSSL 3.6+, including raw XDR public key import/export, an XDR decoder, and CI/test coverage integration alongside existing PQC work (ML-KEM/ML-DSA).

Changes:

• Register LMS keymgmt, signature (verify-only), and XDR decoder implementations in the provider.
• Add LMS unit tests for import/export, XDR decoding, and unsupported operations.
• Extend build/test scripts and CI workflows to support LMS opt-in builds and LMS KAT vector runs.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/unit.h	Adds LMS unit test prototypes behind WP_HAVE_LMS.
test/unit.c	Registers LMS unit tests behind WP_HAVE_LMS.
test/test_lms.c	New LMS-focused unit tests (import/export, decode, unsupported ops).
test/include.am	Adds test/test_lms.c to unit test sources.
src/wp_wolfprov.c	Registers LMS in provider keymgmt/signature/decoder algorithm tables.
src/wp_lms.c	New LMS implementation: keymgmt import/export/match, verify-only signature, XDR decoder.
src/include.am	Adds src/wp_lms.c to library sources.
scripts/utils-wolfssl.sh	Adds LMS configure flags and mismatch checks for existing wolfSSL installs.
scripts/utils-wolfprovider.sh	Adds --enable-lms forwarding and avoids system wolfSSL when PQC/LMS requested.
scripts/utils-openssl.sh	Adds LMS mismatch check and enable-lms for OpenSSL builds when requested.
scripts/test-pqc-kat.sh	Extends KAT runner to optionally include LMS vectors and enforce expected sub-test counts.
scripts/build-wolfprovider.sh	Adds --enable-lms, version gating, and blocks LMS/PQC on FIPS builds and Debian packaging path.
README.md	Documents LMS opt-in usage and its verification-only contract/format expectations.
include/wolfprovider/settings.h	Adds compile-time gating for LMS availability and explicit error messages.
include/wolfprovider/alg_funcs.h	Declares LMS algorithm name and new dispatch tables.
docs/INTEGRATION_GUIDE.md	Documents --enable-lms and expands PQC section to include LMS.
configure.ac	Adds --enable-lms configure option and defines WOLFPROV_HAVE_LMS.
.github/workflows/wolfssl-versions-pqc.yml	Adds an LMS-only matrix row, adjusts eligibility logic, and separates cache variants.
.github/workflows/wolfssl-pqc-kat.yml	Adds LMS to the KAT matrix, caching, build flags, and runtime selection.
.github/workflows/nginx-pqc.yml	Updates PQC floor logic to v5.9.2-stable and adjusts eligibility checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.