[ColtonWilley]

OpenSSL's hybrid KEM keymgmt imports the X25519 public key with DOMAIN_PARAMETERS|PRIVATE_KEY selection, but wp_ecx_import only read PUB_KEY when the PUBLIC_KEY bit was set. With wolfProvider and the default provider both loaded, a TLS 1.3 server therefore rejected every X25519MLKEM768 key share with illegal_parameter. ECX and ML-KEM import now read the public key for any keypair selection, matching ossl_ecx_key_fromdata.

[Copilot]

🟢 Approval recommended

Static review found no blocking issues in the narrow import changes and targeted regression tests; tests were not executed.

No open issues 🎉

What changed in this PR

This PR fixes wolfProvider’s public-key imports for OpenSSL hybrid KEMs, addressing TLS 1.3 X25519MLKEM768 key-share rejection when wolfProvider and the default provider are both loaded.

Changes:

• Allow ECX and ML-KEM public-key imports when either keypair selection bit is set.
• Add regression coverage for public-key imports using DOMAIN_PARAMETERS | PRIVATE_KEY.

File	Description
test/​unit.h	Declare the new X25519 regression test.
test/​unit.c	Register the X25519 regression test.
test/​test_mlkem.c	Extend roundtrip coverage to private-selection public-key imports.
test/​test_ecx.c	Verify X25519 public-key import with private-key selection.
src/​wp_mlkem_kmgmt.c	Read public-key parameters for either keypair selection bit.
src/​wp_ecx_kmgmt.c	Apply the same selection handling to ECX imports.

_{Review effort: Balanced}