chacha_poly: Use IV_STATE guard to prevent IV reuse

chacha_poly: Use IV_STATE guard to prevent IV reuse

If IV was set for Chacha20-Poly1305, code should not
allow reusing IV after calling CipherFinal.

Use iv_state (as used in GCM or OCB mode) to prevent that.

Thanks to Alex Gaynor for reporting the issue.

Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Tue May 12 05:14:09 2026
(Merged from https://github.com/openssl/openssl/pull/31104)