crypto.mlkem: return J(z||c) on implicit rejection
The ML-KEM decapsulation was returning z directly when implicit
rejection was triggered, but FIPS 203 specifies it should return
J(z || c) = SHAKE256(z || c).
a0e9130b89Frank Denis committed on 12/8/2025, 11:55:59 PMparent7f36c4c