tls: exclude PKCS#1 v1.5 RSA from TLS 1.3 signature_algorithms extension

[Copilot]

wolfSSL was unconditionally advertising rsa_sa_algo (PKCS#1 v1.5 RSA) in the signature_algorithms extension even for TLS 1.3 ClientHellos, violating RFC 8446 §4.2.3. The fix operates at three layers to handle both TLS 1.3-only and downgrade-capable builds correctly.

Changes

• src/internal.c — InitSuitesHashSigAlgo()
  Under WOLFSSL_NO_TLS12 (TLS 1.3-only builds), gate rsa_sa_algo additions with if (!tls1_3). In mixed-version builds the in-memory list intentionally retains rsa_sa_algo — the ClientHello is sent before version negotiation completes, so it must remain available for a TLS 1.2 fallback.

• src/tls.c — TLSX_SignatureAlgorithms_GetSize() / TLSX_SignatureAlgorithms_Write()
  Runtime wire-level filter: when IsAtLeastTLSv1_3(ssl->version) && !ssl->options.downgrade, strip rsa_sa_algo pairs (list[i+1] == rsa_sa_algo) from the serialised extension without touching the in-memory list. GetSize and Write use the identical condition so the reported and written lengths always agree. When ssl->options.downgrade is set the filter is skipped, preserving TLS 1.2 compatibility.

• src/tls13.c — DoTls13ServerHello() downgrade path
  After ssl->options.tls1_3 = 0 is set on a confirmed TLS 1.3→1.2 downgrade (via supported_versions), scan suites->hashSigAlgo for any rsa_sa_algo entry; if absent, rebuild with InitSuitesHashSigAlgo(..., tls1_3=0) so PickHashSigAlgo and CertificateVerify have the full PKCS#1 v1.5 RSA set for TLS 1.2 processing.

Downgrade flow (preserved)

Step	State
TLS 1.3 ClientHello sent, downgrade enabled	rsa_sa_algo present on wire (filter skipped)
Server replies TLS 1.2	ssl->version.minor = TLSv1_2_MINOR, tls1_3 = 0
Change 3 fires	rsa_sa_algo restored in hashSigAlgo if missing
PickHashSigAlgo	Selects PKCS#1 v1.5 RSA correctly for TLS 1.2