fix: wipe decoded falcon coefficient buffers on drop

Wrap the f, g, and big_F byte vectors produced by decode_i8 in
Zeroizing so the raw secret coefficients are wiped when read_from
returns, on both the success and error paths.

Author: Jr-kenny

miden-crypto/src/dsa/falcon512_poseidon2/keys/secret_key.rs

@@ -22,7 +22,7 @@ use crate::{
     hash::blake::Blake3_256,
     utils::{
         read_sensitive_array,
-        zeroize::{Zeroize, ZeroizeOnDrop},
+        zeroize::{Zeroize, ZeroizeOnDrop, Zeroizing},
     },
 };
 
@@ -370,20 +370,26 @@ impl Deserializable for SecretKey {
         let chunk_size_g = ((n * WIDTH_SMALL_POLY_COEFFICIENT) + 7) >> 3;
         let chunk_size_big_f = ((n * WIDTH_BIG_POLY_COEFFICIENT) + 7) >> 3;
 
-        let f = decode_i8(&byte_vector[1..chunk_size_f + 1], WIDTH_SMALL_POLY_COEFFICIENT).ok_or(
-            DeserializationError::InvalidValue("Failed to decode f coefficients".to_string()),
-        )?;
-        let g = decode_i8(
-            &byte_vector[chunk_size_f + 1..(chunk_size_f + chunk_size_g + 1)],
-            WIDTH_SMALL_POLY_COEFFICIENT,
-        )
-        .unwrap();
-        let big_f = decode_i8(
-            &byte_vector[(chunk_size_f + chunk_size_g + 1)
-                ..(chunk_size_f + chunk_size_g + chunk_size_big_f + 1)],
-            WIDTH_BIG_POLY_COEFFICIENT,
-        )
-        .unwrap();
+        let f = Zeroizing::new(
+            decode_i8(&byte_vector[1..chunk_size_f + 1], WIDTH_SMALL_POLY_COEFFICIENT).ok_or(
+                DeserializationError::InvalidValue("Failed to decode f coefficients".to_string()),
+            )?,
+        );
+        let g = Zeroizing::new(
+            decode_i8(
+                &byte_vector[chunk_size_f + 1..(chunk_size_f + chunk_size_g + 1)],
+                WIDTH_SMALL_POLY_COEFFICIENT,
+            )
+            .unwrap(),
+        );
+        let big_f = Zeroizing::new(
+            decode_i8(
+                &byte_vector[(chunk_size_f + chunk_size_g + 1)
+                    ..(chunk_size_f + chunk_size_g + chunk_size_big_f + 1)],
+                WIDTH_BIG_POLY_COEFFICIENT,
+            )
+            .unwrap(),
+        );
 
         let f = Polynomial::new(f.iter().map(|&c| FalconFelt::new(c.into())).collect());
         let g = Polynomial::new(g.iter().map(|&c| FalconFelt::new(c.into())).collect());