Fenrir fixes for session, cipher, CRL, and X509 handling

[cconlon]

This PR includes 5 Fenrir fixes:

• F-11873: only copy the HMAC inner buffer back on success in setTlsHmacInner
• F-11879: check GetStringUTFChars results in the WolfSSLContext/WolfSSLSession string wrappers
• F-11885: only resume client-side entries on client session-cache lookup
• F-6735: correct the getCurrentCipher null-check exception message
• F-6736: align the critical/non-critical extension OID getters with the X509Certificate contract

[Copilot]

Pull request overview

This PR applies a set of targeted correctness fixes (“Fenrir” items) across the JNI layer and the JSSE provider, focusing on safer error handling, correct session-cache resumption behavior, and closer adherence to X509Certificate extension-OID contracts.

Changes:

• Prevents leaking uninitialized native data by only copying the TLS HMAC inner buffer back to Java on success, with added regression test coverage.
• Adds GetStringUTFChars() NULL checks across several JNI string wrappers to safely handle allocation failures.
• Improves session cache lookup correctness by avoiding client resumption from server-side cached entries, and aligns critical/non-critical extension OID getters with the X509Certificate contract (with new tests).

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/test/com/wolfssl/test/WolfSSLSessionTest.java	Adds regression coverage for setTlsHmacInner() error-path behavior (no buffer copy-back).
src/test/com/wolfssl/provider/jsse/test/WolfSSLX509Test.java	Adds test asserting critical OID set is empty (not null) when extensions exist but none are critical.
src/test/com/wolfssl/provider/jsse/test/WolfSSLTestFactory.java	Adds client-cert.der path for new X509 extension tests.
src/java/com/wolfssl/WolfSSLSession.java	Updates setTlsHmacInner() documentation to reflect new error-path behavior.
src/java/com/wolfssl/provider/jsse/WolfSSLX509.java	Refactors extension OID getters to share logic and better match X509Certificate null/empty-set requirements.
src/java/com/wolfssl/provider/jsse/WolfSSLAuthStore.java	Prevents client-side resumption from server-side cached entries; clarifies cache overwrite semantics.
native/com_wolfssl_WolfSSLSession.c	Adds GetStringUTFChars() NULL checks, fixes getCurrentCipher null-check message, and gates HMAC-inner copy-back on success.
native/com_wolfssl_WolfSSLContext.c	Adds GetStringUTFChars() NULL checks (including multi-string cleanup in loadVerifyLocations).

Suppressed comments (1)

src/java/com/wolfssl/provider/jsse/WolfSSLAuthStore.java:698

• This updated block comment introduces lines that exceed the 80-character limit (including indentation). Please re-wrap the comment to keep each line within 80 columns.

        /* Only store session into cache if we have a usable key. An existing
         * entry for cacheKey is overwritten, including one from the opposite
         * side since client and server share the host:port key namespace.
         * getSession() guards the read side against reusing a server-side
         * entry for client resumption. */

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.