slh_dsa: cleanse generated add_random buffer

slh_dsa: cleanse generated add_random buffer

Fix the inverted cleanse guard in the SLH DSA provider signing path.

When randomized signing populates the local add_rand buffer, the cleanup step currently skips that stack buffer. Other signing modes do not create this transient buffer, so they should not drive this cleanup. Swap the guard so only the transient per signature buffer is cleansed, and cleanse the full fixed size buffer directly.

Fixes #30950

Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
MergeDate: Sun May  3 14:49:20 2026
(Merged from https://github.com/openssl/openssl/pull/31029)