Support restartable ECDH in TLS 1.2 clients in Mbed TLS 4.x

[gilles-peskine-arm]

In Mbed TLS 4.0 (upcoming), when MBEDTLS_ECDH_RESTARTABLE is enabled, ECDSA signature and verification operations in TLS 1.2 clients are interruptible, i.e. they will return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS regularly during ECC operations to avoid blocking for too long. This does not apply to ECDH operations, however.

This is the continuation of a limitation in Mbed TLS 3.6, where ECDH operations from TLS are only interruptible when MBEDTLS_USE_PSA_CRYPTO is enabled. In Mbed TLS 4.0, the non-PSA code path from TLS no longer exists.

The goal of this issue is to implement interruptibility for ECDH in TLS 1.2 clients, i.e. reach the same level of functionality as Mbed TLS 3.6 for ECC interruptibility in TLS.

Note that TLS 1.3 is out of scope.

[yanesca]

Corresponding investigation task: #7294.