Fix SE050 RSA-PSS signing, key cleanup, and mutex leaks

[LinuxJedi]

RSA-PSS fix:
Skip SE050 hardware path for RSA-PSS sign and verify operations in RsaPublicEncryptEx() and RsaPrivateDecryptEx(). The SE050's PSS sign API (Se05x_API_RSASign) is a hash-then-sign operation, which double-hashes when wolfSSL passes a pre-computed digest (as done during TLS CertificateVerify). PSS operations now fall through to the software RSA path. PKCS#1 v1.5 signing continues to use SE050 hardware.

Key object leak fix:
Add se050_rsa_free_key() called from wc_FreeRsaKey() to erase wolfSSL-allocated RSA key objects from SE050 persistent storage on free. Without this, persistent key slots on the SE050 are never reclaimed and eventually exhaust secure storage. Add matching sss_key_store_erase_key() calls to se050_ecc_free_key(), se050_ed25519_free_key(), and se050_curve25519_free_key(). Only keys with keyId >= SE050_KEYID_START are erased (pre-provisioned keys are left intact).

Mutex leak fix:
Add missing wolfSSL_CryptHwMutexUnLock() calls before early returns in se050_rsa_sign(), se050_rsa_verify(), se050_rsa_public_encrypt(), and se050_rsa_private_decrypt() when the algorithm lookup fails after the mutex has already been acquired.

ZD 21212

[Copilot]

Pull request overview

Fixes SE050 RSA-PSS behavior by routing PSS sign/verify through the software RSA implementation, and addresses SE050 resource leaks (persistent key objects + mutex unlock paths).

Changes:

• Skip SE050 hardware path for RSA-PSS sign/verify to avoid double-hashing.
• Erase wolfSSL-allocated SE050 persistent key objects on key free (RSA/ECC/Ed25519/Curve25519).
• Add missing mutex unlocks on early-return error paths in SE050 RSA operations.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 7 comments.

File	Description
wolfcrypt/src/rsa.c	Routes PSS sign/verify away from SE050 and triggers SE050 RSA key erasure during rsa key free.
wolfcrypt/src/port/nxp/se050_port.c	Adds RSA key erase helper, erases other key types, and fixes missing mutex unlocks; adds SE050 debug logging.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[LinuxJedi]

Copilot comments 4-7 are in debugging code and if we address those we should address across existing code too,

[LinuxJedi]

Jenkins, retest this please - previous run missing