Bugfix
   * Remove PSA'a AEAD finish/verify output buffer limitation for GCM.
     The requirement of minimum 15 bytes for output buffer in
     psa_aead_finish() and psa_aead_verify() does not apply to the built-in
     implementation of GCM.
   * Move GCM's update output buffer length verification from PSA AEAD to
     the built-in implementation of the GCM.
     The requirement for output buffer size to be equal or greater then
     input buffer size is valid only for the built-in implementation of GCM.
     Alternative GCM implementations can process whole blocks only.

API changes
   * New error code for GCM: MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL.
     Alternative GCM implementations are expected to verify
     the length of the provided output buffers and to return the
     MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL in case the buffer length is too small.