fix(protocomm): zeroize SRP session key before free

esp_srp_free() released the 64-byte SHA-512 session_key buffer with a
plain free(), leaving the derived session key resident in heap memory
that can later be reallocated and read back. Wipe it with
mbedtls_platform_zeroize() before freeing.

Closes SEC-120

components/protocomm/src/crypto/srp6a/esp_srp.c

@@ -13,6 +13,7 @@
 #include "esp_srp_mpi.h"
 #include "esp_srp.h"
 #include "esp_check.h"
+#include "mbedtls/platform_util.h"
 
 #define SHA512_HASH_SZ      64
 
@@ -172,6 +173,7 @@ void esp_srp_free(esp_srp_handle_t *hd)
         free(hd->bytes_A);
     }
     if (hd->session_key) {
+        mbedtls_platform_zeroize(hd->session_key, SHA512_HASH_SZ);
         free(hd->session_key);
     }
     free(hd);