Reject overflowing numeric OID components

[subotac]

Description

oid_parse_number() checked the accumulated value before multiplying by 10,
but did not account for the pending digit. Numeric components such as
4294967296 could therefore wrap and be accepted as a different OID value.

Validate the complete multiply-add before updating the accumulator, and add
regression cases for overflow to zero, overflow to a nonzero value, and
continued parsing after a wrap.

Fixes #10910

PR checklist

• changelog provided
• framework PR not required because: no framework changes
• TF-PSA-Crypto development PR not required because: no TF-PSA-Crypto changes
• TF-PSA-Crypto 1.1 PR not required because: no TF-PSA-Crypto changes
• mbedtls development PR this PR
• mbedtls 4.1 PR to be provided after the development fix is accepted
• mbedtls 3.6 PR to be provided after the development fix is accepted
• tests provided