TLS 1.3, plaintext alert: ignore when expecting encrypted

[SparkiDev]

Description

In TLS 1.3, ignore valid unencrypted alerts that appear after encryption has started.
Only ignore WOLFSSL_ALERT_COUNT_MAX-1 alerts.

Fixes zd#20857

Testing

./configure --disable-shared
make
./tests/unit.test -test_tls13_plaintext_alert

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[devin-ai-integration]

🛟 Devin Lifeguard found 1 likely issues in this PR

• check-all-return-codes snippet snippet snippet: Capture and assert the return value of wolfSSL_SetIORecv, wolfSSL_SetIOSend and wolfSSL_SetIOReadCtx (e.g. ExpectIntEQ(wolfSSL_SetIORecv(ctx, MbRecv), WOLFSSL_SUCCESS);).

@SparkiDev
please take a look at the above issues which Devin flagged. Devin will not fix these issues automatically.

[rizlik]

If the goal of this PR is to protect against DoS I don't think it's a good idea:

• under TCP one can easily forge a RST packet and close the connection
• peer can still forge arbitrary packets that cause the handshake to error out (handshake, app_data) ecc

UDP is different but DtlsShouldDrop ignores plaintext packet after handshake keys are computed.

[SparkiDev]

DoS can be done by any message, it doesn't have to be a valid alert.
But yes that is the report.

Instead the PR is about skipping alerts that were sent by the client before it received anything from the server to indicate it should be encrypted. OpenSSL and others do this.

May make this a compile time option.

[SparkiDev]

retest this please