Addresses F-2605, F-2606, F-2607, F-2608, F-2609, F-2611, F-2615, F-2616

• Save heap before calling *_Free in wc_AesDelete, wc_HashDelete, wc_MlKemKey_Delete — prevents UAF if future Free zeroes the struct.
• Add NULL validation to wc_HKDF_Extract_ex (out, inKey/inKeySz) and to all four SRTP/SRTCP KDF public APIs (idx when kdrIdx >= 0).
• ForceZero the signature buffer on write_private_key failure in wc_LmsKey_Sign (native and external hash-sigs wrapper) to prevent OTS key reuse after NV rollback; matches existing XMSS pattern.

Added a few unit tests