Signed-off-by: seanjin99 <[email protected]>

Signed-off-by: seanjin99 <[email protected]>

- Add check_c_compiler_flag() for analyzer warning suppressions
- Suppress test output with CMAKE_REQUIRED_QUIET
- Apply clang-tidy flags only on GitHub Actions CI
- Fixes macOS build while preserving CI analyzer functionality
- Code cleanup: refactor digest.c, restore cmac_context do-while pattern
- Remove dead code: MBEDTLS_ALLOW_PRIVATE_ACCESS, empty if statements

Analyzer flags only work when --analyze is enabled, so checking them
without analyzer active gives false results. Use ENV{CI} consistently
to apply flags only on GitHub Actions where analyzer is enabled.

- Fixed root key initialization race conditions in otp.c
  * Added thread-safe initialization using C11 once_flag and call_once
  * Replaced unprotected static variables with call_once pattern
  * Added init_root_key() and init_common_root_key() initialization functions
  * Added failure tracking for proper error handling

- Removed unnecessary mutex from rand_bytes() in rand.c
  * mbedTLS already provides thread-safety via MBEDTLS_THREADING_C
  * Eliminates lock contention with 255+ concurrent threads

Test Results:
- SaCryptoCipherMultipleThread.processMultipleThread now passes 10/10 runs
- Previously failed consistently due to HMAC signature mismatches
- Performance: 248-419ms with 255 concurrent threads

- Fixed session double-check locking race in client_session()
  - Removed unprotected read of session variable before mutex
  - All session checks now properly protected by mutex
  - Prevents race where one thread reads while another writes

- Applied mbedTLS 3.6.2 CTR counter performance optimization
  - Backported optimized counter increment (32-bit word operations)
  - Added ctr.h header with mbedtls_ctr_increment_counter()
  - Modified patch_mbedtls.cmake to apply optimization during build
  - Fixed unused variable warning in aes.c

Verified with ThreadSanitizer: 0 races detected
Multi-threaded tests (255 threads): All passed