wpa-supplicant: fix CVE-2022-23303-4

The implementations of SAE in hostapd before 2.10 and wpa_supplicant
before 2.10 are vulnerable to side channel attacks as a result
of cache access patterns. NOTE: this issue exists because of an
incomplete fix for CVE-2019-9494.

Backport patches from:
https://w1.fi/security/2022-1/



CVE: CVE-2022-23303 CVE-2022-23304

Signed-off-by: Steve Sakoman <steve@sakoman.com>