Tighten Kyber decrypt parsing and deterministic malformed-ciphertext errors

[Psychevus]

Motivation

• Ensure kyber_decrypt strictly validates ciphertext structure to prevent out-of-bounds parsing and avoid accepting truncated inputs.
• Make error reporting deterministic: malformed ciphertext must raise DecryptionError rather than leaking lower-level exceptions like ValueError or InvalidTag.

Description

• Enforced a minimum ciphertext length by requiring ct_size + 16 + 12 + 16 (KEM ciphertext + salt(16) + nonce(12) + tag(16)) before parsing.
• Wrapped KEM decapsulation (alg.decrypt) errors and AES-GCM decryption errors in DecryptionError("Invalid ciphertext") to normalize failure reporting.
• Added tests that assert malformed inputs produce DecryptionError, and imported DecryptionError into the test module.
• New tests cover short ciphertext rejection and corruption of the nonce and tag regions in the Kyber payload.

Testing

• Ran pytest -q tests/test_pqc.py, which completed successfully with 6 passed.
• New negative tests added: short ciphertext path and corrupted nonce/tag paths each assert DecryptionError is raised (these tests passed).