Add function for constant-flow variable-length HMAC computation

[mpg]

Decryption/authentication of (D)TLS record encrypted with legacy CBC (that is CBC without EtM) includes computing the HMAC of the decrypted, unpadded data, without leaking its length (as this would leak information about the padding, exploited by the Lucky 13 attack.

Currently this is done using dummy evaluations of the compression function as described in the original Lucky 13 paper, section 7, "Careful implementation of MEE-TLS-CBC decryption", point 5. However subsequent research has shown while effective against remote attackers, this tends to be fragile when facing local attackers. A more robust strategy is described in this post, section "Calculating the MAC".

This task is to implement a function using that strategy with a signature like for example:

int mbedtls_ssl_ct_hmac( mbedtls_md_context_t *ctx,
                         const unsigned char *add_data, size_t add_data_len,
                         const unsigned char *data, size_t data_len_secret,
                         size_t min_data_len, size_t max_data_len,
                         unsigned char output[MBEDTLS_MD_MAX_SIZE] );

such that it is functionally equivalent to

mbedtls_md_hmac_update( ctx, add_data, add_data_len );
mbedtls_md_hmac_update( ctx, data, data_len_secret );
mbedtls_md_hmac_finish( ctx, output );

as long as min_data_len <= data_len_secret <= max_data_len but with no branches or memory access patterns depending on data_len_secret.

This function must come with unit tests. In the development branch, it should probably be defined in ssl_msg.c and be declared MBEDTLS_STATIC_TESTABLE. In the LTS branches, it should probably be defined in ssl_tls.c and declared in ssl_internal.h.

Note: this task is just about creating the function and its unit tests, not necessarily integrating it in ssl_decrypt_buf() yet. This is to avoid a dependency on #3469 (negative testing of ssl_decrypt_buf()). However if #3469 is ready before this one, then creating this function and integrating it in ssl_decrypt_buf() can be done in the same PR