Fix DoKexDhReply() to reject the server's pub key if no PublicKeyCheck callback is registered

[yosuke-wolfssl]

This PR fixes the default behavior of DoKexDhReplay() so that this rejects the pub key if no callback is registered.
Also, the new regression test case is added for that.

[Copilot]

Pull request overview

This PR tightens the client-side KEXDH reply handling by changing DoKexDhReply() to reject a server host key when no PublicKeyCheck callback is registered, and adds a regression test to ensure this behavior is enforced.

Changes:

• Update DoKexDhReply() to return WS_PUBKEY_REJECTED_E when publicKeyCheckCb is NULL.
• Extend the KEXDH reply regression harness to optionally skip registering PublicKeyCheck.
• Add regression coverage asserting handshake failure when no PublicKeyCheck callback is configured.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/internal.c	Changes default KEXDH reply behavior to reject server public keys when no verification callback is registered.
tests/regress.c	Adds a regression test and harness option to validate the new default rejection behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.