Fixes for PSK hint, timeout range, peer-name and cookie-callback JNI cleanup

[cconlon]

This PR includes five Fenrir fixes:

• F-12672: Forward a null PSK identity hint to the Java client callback instead of rejecting the handshake.
• F-12673: Reject setTimeout values outside [0, UINT32_MAX] with BAD_FUNC_ARG instead of truncating them.
• F-12674: Guard the peer issuer/subject getters against a null name conversion before calling NewStringUTF.
• F-12675: Release every JNI local reference on all exit paths of the DTLS cookie generation callback.
• F-12703: List examples/provider ahead of the wolfcrypt-jni jar so the example's own main class resolves first.

[Copilot]

Pull request overview

This PR addresses several JNI/JSSE edge cases in wolfssljni (Fenrir fixes) around PSK hint handling, timeout validation, peer-name getters, DTLS cookie callback JNI cleanup, and example/runtime classpath ordering.

Changes:

• Add JNI validation for setTimeout inputs and corresponding new unit test coverage for invalid ranges.
• Harden JNI peer certificate issuer/subject getters against null conversions; improve DTLS cookie callback local-ref cleanup.
• Allow PSK client callback to be invoked even when the native PSK hint is NULL; reorder example classpath so the example main class resolves first.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/test/com/wolfssl/test/WolfSSLSessionTest.java	Adds a new test covering invalid setTimeout values and state preservation.
src/test/com/wolfssl/provider/jsse/test/WolfSSLParametersPskTest.java	Adds a new engine handshake test for the “no server PSK hint” case.
src/java/com/wolfssl/WolfSSLSession.java	Updates setTimeout Javadoc to document the accepted range and return behavior.
native/com_wolfssl_WolfSSLSession.c	Enforces setTimeout range in JNI; guards against NULL issuer/subject name conversion.
native/com_wolfssl_WolfSSLContext.c	Cleans up JNI local references across all DTLS cookie callback exit paths; allows NULL PSK hints.
examples/provider/DualProviderFIPSTest.sh	Reorders runtime classpath to prioritize examples/provider.
.github/workflows/fips-ready-dual-provider.yml	Matches classpath ordering change in CI for DualProviderFIPSTest runtime.

Suppressed comments (1)

src/test/com/wolfssl/provider/jsse/test/WolfSSLParametersPskTest.java:405

• The assertions currently require an empty string hint, but the native fix explicitly allows the hint pointer to be NULL, which will surface to Java as null (see NativePskClientCb creating no jstring when hint == NULL). Adjust the test to (1) assert the callback ran (using a sentinel) and (2) accept null or empty string as the “no hint” case.

        /* Absent server hint arrives as an empty String, not a failure */
        assertNotNull("PSK client callback did not receive a hint",
            recvHint[0]);
        assertEquals("", recvHint[0]);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.