Add bounds check on KRB5KDF constant length to prevent buffer overflow

[ColtonWilley]

Summary

wp_kdf_krb5kdf_derive passes ctx->constantSz to n_fold, which does XMEMCPY(block, constant, constant_len) into the fixed 16-byte stack buffer block[AES_BLOCK_SIZE]. A constant longer than the block size overflows the stack (and triggers a size_t underflow in a later XMEMSET). n_fold's documented precondition requires constant_len <= blocksize, but the caller never enforced an upper bound. OpenSSL's KRB5KDF guards against this; we now do too.

Changes

• src/wp_krb5kdf.c: reject constantSz > AES_BLOCK_SIZE before calling n_fold.
• test/test_krb5kdf.c: negative test with an oversized constant; runs against both wolfProvider and OpenSSL (both must reject).

Testing

Full suite passes; test_krb5kdf confirms both providers reject the oversized constant.

Fixes fenrir F-4076