dtls13: epoch mangament improvement and bug fixes

[rizlik]

1. NULL-ify Dtls13DecryptEcpoch if the pointed epoch is evicted
2. Use only epoch that can decrypt as candidate for decrypting records
3. Never evict Peer epoch - 1 as it can be active

[Copilot]

Pull request overview

This PR tightens DTLS 1.3 epoch lifecycle handling to avoid stale/invalid decrypt-epoch pointers, ensure only decrypt-capable epochs are considered for incoming record processing, and prevent eviction of epochs that may still be active due to KeyUpdate/ACK loss. It also adds regression tests covering epoch slot reuse, replay behavior, and rejection of post-handshake plaintext records.

Changes:

• Enforce a minimum DTLS 1.3 epoch slot count and expose Dtls13NewEpoch for testing/prefix-mapped builds.
• Make epoch reconstruction and eviction logic DTLS13-aware: skip encrypt-only epochs for decryption and preserve peer epoch − 1; NULL-out dtls13DecryptEpoch when its slot is evicted.
• Reject DTLSPlaintext records (epoch 0) after handshake completion and add new DTLS13 API tests for the above behaviors.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
wolfssl/internal.h	Enforces DTLS13_EPOCH_SIZE >= 4 and makes Dtls13NewEpoch test-visible/prefix-mapped.
src/dtls13.c	Improves epoch candidate selection and eviction safety (preserve peer epoch − 1; NULL decrypt epoch on eviction).
src/internal.c	Hardens record header processing for DTLS13 (recover when decrypt epoch is NULL; drop post-handshake plaintext).
tests/api/test_dtls13.h	Registers new DTLS13 regression tests.
tests/api/test_dtls13.c	Adds regression tests for epoch slot reuse, replay protection continuity, and post-handshake plaintext ACK dropping.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 181,156 B / 1,048,576 B, total: 17% used)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753