Release the lock in mbedtls_sha256_free if it was not released already

[nilswiersma]

Release the lock in mbedtls_sha256_free if it was not released already. Requires making pico_sha256_unlock include-able. Fixes #2103.

[kilograham]

I think i'd prefer to expose something like

void pico_sha256_cleanup(pico_sha256_state_t *state, sha256_result_t *out) {
   if (state->locked) {
       pico_sha256_unlock(state);
   }
}

[peterharperuk]

I wrote a test for this. I'll push this if you want @kilograham