aes-gcm: wire zeroize feature to deps and mark AesGcm as ZeroizeOnDrop

aes-gcm/Cargo.toml

@@ -40,6 +40,7 @@ bytes = ["aead/bytes"]
 getrandom = ["aead/getrandom"]
 hazmat = []
 rand_core = ["aead/rand_core"]
+zeroize = ["dep:zeroize", "aes?/zeroize", "ghash/zeroize"]
 
 [package.metadata.docs.rs]
 all-features = true

aes-gcm/src/lib.rs

@@ -367,3 +367,14 @@ where
         tag
     }
 }
+
+// `AesGcm` intentionally has no custom `Drop`.
+// With the `zeroize` feature enabled, sensitive state is cleared by member drops
+// (`cipher` via `Aes`, `ghash` via internal `Polyval`) after this marker impl.
+#[cfg(feature = "zeroize")]
+impl<Aes, NonceSize, TagSize> zeroize::ZeroizeOnDrop for AesGcm<Aes, NonceSize, TagSize>
+where
+    Aes: zeroize::ZeroizeOnDrop,
+    TagSize: self::TagSize,
+{
+}