fips: keep PRIVATE_KEY_UNLOCK/op/LOCK inside a single cgo call - #59

This PR fixes a FIPS-threading correctness issue by ensuring the “private-key gate” (unlock → wolfCrypt op → lock) happens within a single cgo call, preventing goroutine rescheduling onto a different OS thread mid-sequence.

Changes:

• Add per-operation static C helpers that wrap unlock/op/lock inside one cgo call for HKDF, PBKDF2, and selected ECC operations.
• Expand and clarify FIPS private-key gate documentation and threading requirements in fips.go.

Suppressed comments (3)

fips.go:38

• The WC_SPKRE_F macro is referenced by WC_PRIVATE_KEY_LOCK/UNLOCK but its definition was removed, leaving WC_SPKRE_F undefined in the C preamble (build will fail). Reintroduce the macro (or call wolfCrypt_SetPrivateKeyReadEnable_fips directly).

// int WC_PRIVATE_KEY_LOCK(void) {
//      return WC_SPKRE_F(0,WC_KEYTYPE_ALL);
// }
// int WC_PRIVATE_KEY_UNLOCK(void) {
//      return WC_SPKRE_F(1,WC_KEYTYPE_ALL);

ecc.go:148

• This C helper calls PRIVATE_KEY_UNLOCK/LOCK, which are Go functions and not available to C. Switch to WC_PRIVATE_KEY_UNLOCK/WC_PRIVATE_KEY_LOCK and declare them to avoid implicit-declaration errors on clang.

//     PRIVATE_KEY_UNLOCK();
//     ret = wc_ecc_export_x963_ex(key, out, outLen, compressed);
//     PRIVATE_KEY_LOCK();

ecc.go:158

• This C helper calls PRIVATE_KEY_UNLOCK/LOCK, which are Go functions and not available to C. Use WC_PRIVATE_KEY_UNLOCK/WC_PRIVATE_KEY_LOCK (and declare them) so the helper compiles/links correctly.

//     PRIVATE_KEY_UNLOCK();
//     ret = wc_ecc_shared_secret(private_key, public_key, out, outLen);
//     PRIVATE_KEY_LOCK();

• Files reviewed: 4/4 changed files
• Comments generated: 3
• Review effort level: Lite