Add KAT for ML-KEM

[DarkaMaul]

As part of #14598 , this PR adds KAT for ML-KEM.\

Warning: the test vectors are heavy (36 MB) because they contain 1000 vectors, and it bumps the total size of the vectors in the repo by 30%! For comparison, ML-DSA only has 100 vectors.

At the moment in the PR, I have kept the files as-is, but I think we could trim them down to only the first hundred vectors each. WDYT?

[alex]

Before I merge, have we confirmed these vectors are useful for us (i.e., they are usable as seed only)?

[DarkaMaul]

Yes, the format is described here: MLKEM#file-format

On the 11 fields we are using:

• d and z the two 32 bytes components that are used to construct the seed in Algorithm 16
• pk -- expected public key
• ct -- valid ciphertext
• ss -- expected shared secret from valid decapsulation
• ct_n -- invalid ciphertext from implicit rejection
• ss_n -- expected shared secret from implicit rejection

And the four that we do not use:

• msg -- encapsulation randomness (can't test, no deterministic encaps API)
• seed -- AES-CTR-DRBG seed
• sk -- full expanded secret key
• count -- test number