Add missing ForceZero calls

[Frauschi]

F-13, F-14, F-197, F-198, F-199, and F-200. All at once as these are very similar.

[Copilot]

Pull request overview

Adds explicit zeroization of sensitive buffers (ForceZero + optional wc_MemZero_Check) to address several missing wipe sites across TLS 1.2/1.3 key derivation paths.

Changes:

• Ensure temporary key material in TLS 1.3 secret derivation is wiped before returning.
• Wipe PRF/key-derivation intermediate buffers in TLS 1.2/legacy paths before freeing.
• Introduce misc include plumbing in keys.c to make ForceZero available.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/tls13.c	Adds cleanup path to wipe derived key buffer(s) in TLS 1.3 secret derivation.
src/tls.c	Wipes PRF digest buffer before freeing in TLS key derivation.
src/keys.c	Wipes multiple TLS 1.0–1.2 derivation intermediates; replaces manual loops with ForceZero; adds ForceZero include wiring.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[SparkiDev]

Change this to wc_MemZero_Add at the top.
That way all code paths will be checked.
Check will then happen in free.

[Frauschi]

Added the missing wc_MemZero_Add() calls at the top (TIL that these are required to make wc_MemZero_Check() actually check something...).

However, we cannot remove the manual wc_MemZero_Check() calls here, as XFREE is only called for WOLFSSL_SMALL_STACK builds. Hence, the check would be missing for stack allocations.