Enable SHA3 on the secure wolfHSM server for the STM32H5 TrustZone port

[aidangarske]

• The STM32H5 TrustZone wolfHSM non-secure client is built with WOLFSSL_SHA3, but the secure-side server was not.
• Direct SHA3 client requests reach the server and get NOT_COMPILED_IN (-174) back, so the wolfHSM SHA3 async tests fail.
• Regular SHA3 hashing only looked fine because the client callback quietly redid the hash in software.
• This has failed the wolfHSM nightly wolfBoot TrustZone integration job since the wolfHSM SHA3 tests landed
  (Nightly wolfBoot TrustZone (m33mu) integration failed wolfHSM#412).
• Define WOLFSSL_SHA3 in the secure WOLFCRYPT_TZ_WOLFHSM block of include/user_settings.h, next to SHA384 and SHA512.
• Link sha3.o in the WOLFCRYPT_TZ_WOLFHSM object list in options.mk, guarded like the other blocks when HASH=SHA3.
• Secure image text is 162952 bytes, which fits the 256 KB secure flash.
• Tested with make in port/stmicro/stm32h5-tz-wolfhsm and m33mu in the wolfboot-ci-m33mu container against wolfHSM main;
  whTest_ClientConfig PASSED and all four SHA3 async variants succeed.

[Copilot]

Copilot review overview

🔵 Needs a closer look

Ensure sha3.o is included when HASH=SHA3 and HASH_HAL is non-empty.

Review effort: Lite
Findings: None

What changed in this PR

Enables SHA3 support in the STM32H5 TrustZone secure wolfHSM server.

Changes:

• Enables WOLFSSL_SHA3 in secure-side settings.
• Links sha3.o for secure wolfHSM builds.

File	Summary
options.mk	Adds the SHA3 implementation object; the HASH_HAL path still requires handling.
include/​user_settings.h	Enables SHA3 in the secure wolfHSM configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.