MD: HMAC in DTLS cookies

[mpg]

In ssl_cookie.c, when MBEDTLS_USE_PSA_CRYPTO is enabled, move from using the mbedtls_md_hmac API to the psa_mac API, and from using the user-provided RNG for key generation to using psa_generate_key().

• In struct mbedtls_ssl_cookie_ctx, store the key as a mbedtls_svc_key_id_t instead of a mbedtls_md_context_t, with corresponding adaptations in mbedtls_ssl_cookie_init() / mbedtls_ssl_cookie_free().
• In mbedtls_ssl_cookie_setup(), set up appropriate attributes and use psa_generate_key().
• In ssl_cookie_hmac(), use psa_mac_sign_setup(), psa_mac_update() and psa_mac_sign_finish().

Note: the hmac_ctx in the cookie_ctx serves two purposes: (1) store the key, and (2) provide a context for multi-part operations. With PSA those roles are distinct; only the key needs to be in the context, the psa_mac_operation_t object should be internal to ssl_cookie_hmac().

Possible follow-ups (either do them in the same PR if easy enough, or open (an) issue(s) to track):

• When MBEDTLS_USE_PSA_CRYPTO is enabled, we no longer need a mutex in the cookie_ctx to protect the mbedtls_md_context_t, since the psa_mac_operation_t object is now local to the function that uses it. OTOH, when a serial field is present, incrementing it should be protected by the mutex (this is a pre-existing bug).
• The current implementation only uses psa_mac_sign and, for verification, does the constant-time memcmp() manually. Would it be better to use psa_mac_verify? Perhaps not (less code sharing between generation and verification). We need to make a decision.

[superna9999]

@mpg I implemented both follow-ups, and I have some remarks:

• mutex: while removing it for PSA API usage is right, indeed serial should be protected. Is there an issue linked to that ?
• psa_mac_verify_XX: there is no clean way to share code with non-PSA while using psa_mac_verify_XX API, but adding the PSA verify code in mbedtls_ssl_cookie_check() isn't as ugly as I thought, and I think the ssl_cookie_hmac() should be non-PSA only and an inline psa_mac_sign_XX code should replace the only remaining call to ssl_cookie_hmac()

[mpg]

mutex: while removing it for PSA API usage is right, indeed serial should be protected. Is there an issue linked to that ?

Not that I know of (I've looked a bit and couldn't find any issue). Would you be interested in creating a PR to fix that once #5602 is merged? That would mean also creating a PR for 2.28 as bug fixes need backporting. If you'd rather not and prefer to focus on PSA work instead, no problem of course, I'll just open an issue to track this.