Release Summary:

Adds support for PQ only policies, which should not include classical ECC curves. This feature only works on libcryptos that support TLS 1.3 and PQ kem groups.

Description of changes:

1. Modify s2n_generate_default_ecc_key_share() and s2n_process_client_hello() to skip the classical ECC path when a PQ only policy is provided.
2. Check available kem groups and throw errors when setting an invalid policy via s2n_config_set_cipher_preferences or s2n_connection_set_cipher_preferences.
3. Define a PQ only test policy test_pq_only and upload the policy snapshot.
4. Add unit tests in s2n_pq_mlkem_policies_test.c and assert on different behaviors/errors depending on libcryptos.

Testing:

Existing tests with non PQ-only policies should continue to pass. I also added unit tests specific to PQ-only policies.

Run the test with the latest AWS-LC (PQ supported):

Running /home/ubuntu/s2n-tls/tests/unit/s2n_pq_mlkem_policies_test.c ... PASSED        382 tests

Run the test again with my default libcrypto (PQ unsupported):

Running /home/ubuntu/s2n-tls/tests/unit/s2n_pq_mlkem_policies_test.c ... PASSED        349 tests

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.