nss: Upgrade 3.132 -> 3.133

Upgrade to release 3.133:

- Bug 1989541 - Use FIPS-aware key extraction in the PBKDF2 long
  password test.
- Bug 1989541 - Prehash PBKDF2 passwords longer than the HMAC block
  size.
- Bug 1989541 - Use CK_PKCS5_PBKD2_PARAMS with softoken older than
  3.114.
- Bug 2087641 - Harden inline attribute value handling in softoken.
- Bug 2082793 - Don't cache sessions when ECH was rejected.
- Bug 2082792 - Keep DTLS handshake messages whole in the send
  buffer.
- Bug 2082077 - Initialize sftk_MACCtx in sftk_MAC_Init.
- Bug 2082027 - reorder session context setup in sftk_doMACInit.
- Bug 2083840 - Move CLAUDE.md into AGENTS.md.
- Bug 2083840 - Add text to CLAUDE.md regarding code comments and
  searchfox-cli.
- Bug 2084251 - Fix cf_status_nss clearing base-release bugs on
  point releases.
- Bug 2039884 - Use vectorized Hacl_Chacha20Poly1305_128 on aarch64
  above 512 bytes.
- Bug 2046805 - Add SSL_EnablePlaintextResumptionExport
  experimental API.
- Bug 2046805 - Collapse resumption token append boilerplate into
  macros.
- Bug 2086058 - Reject not empty parameters in ML-KEM && ML-DSA
  AlgorithmIdentifiers.
- Bug 2085825 - harden release assertion in
  sftk_DestroySessionObjectData.
- Bug 2085776 - signver: Exit with 0 after a successful -A.

Signed-off-by: Leon Anavi <leon.anavi@konsulko.com>
Signed-off-by: Khem Raj <khem.raj@oss.qualcomm.com>

meta-oe/recipes-support/nss/nss/0001-nss-fix-support-cross-compiling.patch

@@ -1,4 +1,4 @@
-From c15470d6b52986a8e41f9be4579c88ed80413b44 Mon Sep 17 00:00:00 2001
+From 456896494f7299b479a56fa630cc1cc204af4465 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Wed, 22 Feb 2017 11:36:11 +0200
 Subject: [PATCH] nss: fix support cross compiling
@@ -15,7 +15,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  2 files changed, 8 insertions(+), 2 deletions(-)
 
 diff --git a/nss/coreconf/arch.mk b/nss/coreconf/arch.mk
-index 711d19d..a163d24 100644
+index fbc15ef..2449821 100644
 --- a/nss/coreconf/arch.mk
 +++ b/nss/coreconf/arch.mk
 @@ -26,11 +26,11 @@ OS_ARCH := $(subst /,_,$(shell uname -s))
@@ -33,7 +33,7 @@ index 711d19d..a163d24 100644
  
  
 diff --git a/nss/lib/freebl/Makefile b/nss/lib/freebl/Makefile
-index e744314..0ebfc92 100644
+index 057b458..22977e1 100644
 --- a/nss/lib/freebl/Makefile
 +++ b/nss/lib/freebl/Makefile
 @@ -36,6 +36,12 @@ ifdef USE_64
@@ -49,6 +49,3 @@ index e744314..0ebfc92 100644
  ifdef USE_ABI32_FPU
  	DEFINES += -DNSS_USE_ABI32_FPU
  endif
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0002-nss-no-rpath-for-cross-compiling.patch

@@ -1,4 +1,4 @@
-From 621023bc696d3d26a4179dbbafb42d79bef1faf9 Mon Sep 17 00:00:00 2001
+From d8f6570863ca3d553d98e7491f6d65eba8440e15 Mon Sep 17 00:00:00 2001
 From: Hongxu Jia <hongxu.jia@windriver.com>
 Date: Sat, 7 Mar 2020 08:34:02 -0800
 Subject: [PATCH] nss:no rpath for cross compiling
@@ -26,6 +26,3 @@ index 6401778..e5c4e16 100644
  endif
  endif
  
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0003-nss-fix-incorrect-shebang-of-perl.patch

@@ -1,4 +1,4 @@
-From 6aec640342088498cb1b0a2e395eb3da297a48b4 Mon Sep 17 00:00:00 2001
+From bdd47ee2ad3c6e04fac9ff6e6d06851bcc063a1a Mon Sep 17 00:00:00 2001
 From: Ovidiu Panait <ovidiu.panait@windriver.com>
 Date: Mon, 13 Jul 2020 12:12:31 +0300
 Subject: [PATCH] nss: fix incorrect shebang of perl
@@ -89,6 +89,3 @@ index f29f60a..850332a 100755
  
  ########################################################################
  #
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0004-nss-disable-Wvarargs-with-clang.patch

@@ -1,4 +1,4 @@
-From 72c3150300975524bb0001b5a731f077852c95ab Mon Sep 17 00:00:00 2001
+From d20bdad1360fb57c62660522d5a385e51dca641e Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 7 Mar 2020 08:34:02 -0800
 Subject: [PATCH] nss: disable Wvarargs with clang
@@ -40,6 +40,3 @@ index a569a49..687fe58 100644
        # -Wno-parentheses-equality : because clang warns about macro expansions
        WARNING_CFLAGS += $(call disable_warning,parentheses-equality)
        ifdef BUILD_OPT
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0005-nss-does-not-build-on-mips-with-clang-because-wrong-.patch

@@ -1,4 +1,4 @@
-From 5935755eef43ac7cb8f4567e7bed5892180f954c Mon Sep 17 00:00:00 2001
+From 452f42bb1c6dc4281b5879c6fb6f85e5c33c21f3 Mon Sep 17 00:00:00 2001
 From: Khem Raj <raj.khem@gmail.com>
 Date: Sat, 7 Mar 2020 08:34:02 -0800
 Subject: [PATCH] nss: does not build on mips with clang because wrong types
@@ -16,7 +16,7 @@ Signed-off-by: Khem Raj <raj.khem@gmail.com>
  1 file changed, 2 insertions(+), 2 deletions(-)
 
 diff --git a/nss/lib/freebl/pqg.c b/nss/lib/freebl/pqg.c
-index 62d46b5..8c8665d 100644
+index 73ff540..64a5e22 100644
 --- a/nss/lib/freebl/pqg.c
 +++ b/nss/lib/freebl/pqg.c
 @@ -326,8 +326,8 @@ generate_h_candidate(SECItem *hit, mp_int *H)
@@ -30,6 +30,3 @@ index 62d46b5..8c8665d 100644
            SECItem *seedout)
  {
      mp_int s, sum, modulus, tmp;
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0006-Fix-nss-multilib-build-on-openSUSE-11.x-32bit.patch

@@ -1,4 +1,4 @@
-From 895e76e75dbb993a8f445072c190a9db4ee50d15 Mon Sep 17 00:00:00 2001
+From 8bc8f1e64df1a285c902c4cbf272fa6e6f0f8e69 Mon Sep 17 00:00:00 2001
 From: Wenzong Fan <wenzong.fan@windriver.com>
 Date: Sat, 7 Mar 2020 08:34:02 -0800
 Subject: [PATCH] Fix nss multilib build on openSUSE 11.x 32bit
@@ -40,6 +40,3 @@ index 337cbeb..dd77fbe 100644
  ifeq (,$(filter-out WIN%,$(OS_TARGET)))
  PROGRAM		=
  TARGETS		=
--- 
-2.25.1
-

meta-oe/recipes-support/nss/nss/0007-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch

@@ -1,4 +1,4 @@
-From 459ee39104228a958a0999e1a7d4c43e4e6fe4f0 Mon Sep 17 00:00:00 2001
+From c36282f11d9714502c82d290e968634c1e8b0db6 Mon Sep 17 00:00:00 2001
 From: Alexander Kanavin <alex.kanavin@gmail.com>
 Date: Wed, 18 Dec 2019 12:29:50 +0100
 Subject: [PATCH] freebl: add a configure option to disable ARM HW crypto
@@ -14,7 +14,7 @@ Signed-off-by: Alexander Kanavin <alex.kanavin@gmail.com>
  1 file changed, 3 insertions(+)
 
 diff --git a/nss/lib/freebl/Makefile b/nss/lib/freebl/Makefile
-index 0ebfc92..3ee7623 100644
+index 22977e1..febe407 100644
 --- a/nss/lib/freebl/Makefile
 +++ b/nss/lib/freebl/Makefile
 @@ -142,6 +142,8 @@ endif

meta-oe/recipes-support/nss/nss_3.133.bb

@@ -33,7 +33,7 @@ SRC_URI = "https://ftp.mozilla.org/pub/security/nss/releases/${VERSION_DIR}/src/
            file://0006-Fix-nss-multilib-build-on-openSUSE-11.x-32bit.patch \
            file://0007-freebl-add-a-configure-option-to-disable-ARM-HW-cryp.patch \
            "
-SRC_URI[sha256sum] = "ee9cf4837ba801141a804321c4462ad8f452ff4314275c6d5108a6b05af227ff"
+SRC_URI[sha256sum] = "4d752526b9846a1d962588cfbd09b7cc2a4f6a4effbd9157d58a30e8a2573065"
 
 UPSTREAM_CHECK_URI = "https://ftp.mozilla.org/pub/security/nss/releases/"
 UPSTREAM_CHECK_REGEX = "NSS_(?P<pver>\d+(\_\d+)+)"