ML-DSA: Fix poly_uniform

In the second and later squeezes, it squeezes SHAKE128_BLOCK_SIZE
(168) bytes, but then it uses only the first DILITHIUM_SEEDBYTES
(32) bytes.

Now, that 32 is on top of the 840-byte first squeeze, so there are 872
correct bytes which is enough for 290 samples.  So an incorrect matrix
would be generated only if more than 290 samples happen to be required
to get the 256 coefficients.  q / 2^23 = ~99.9% of coefficients are
accepted, so that number of rejections would be pretty unlikely.

Reported-by Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Stephan Mueller <smueller@chronox.de>

Author: smuellerDD

ml-dsa/src/dilithium_poly.c

@@ -96,7 +96,7 @@ void poly_uniform(poly *a, const uint8_t seed[LC_DILITHIUM_SEEDBYTES],
 			buf[i] = buf[buflen - off + i];
 
 		lc_hash_final(hash_ctx, buf + off);
-		buflen = LC_DILITHIUM_SEEDBYTES + off;
+		buflen = LC_SHAKE_128_SIZE_BLOCK + off;
 		ctr += rej_uniform(a->coeffs + ctr, LC_DILITHIUM_N - ctr, buf,
 				   buflen);
 	}