fix: correct KEM output truncation and EVP_PKEY_paramgen double-free

[tofay]

Two bug fixes in the KEM implementation:

1. Truncation: encapsulate_to_vec and decapsulate_to_vec now truncate their output buffers to the actual written length. A short write would otherwise leave trailing zeros in the shared secret, which is a key agreement that silently disagrees with the peer.

2. Double-free: from_encoded_public_key no longer passes a pre-allocated EVP_PKEY to EVP_PKEY_paramgen. The function frees the passed pointer on failure, leaving a dangling pointer that is then freed again on the error path. Now passes NULL and lets paramgen allocate.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.32%. Comparing base (6fa403d) to head (d4bc793).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
src/openssl_internal/kem.rs	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #50      +/-   ##
==========================================
- Coverage   81.49%   81.32%   -0.17%     
==========================================
  Files          21       21              
  Lines        1967     1971       +4     
==========================================
  Hits         1603     1603              
- Misses        364      368       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.