Encapsulation/decapsulation failure

[bwesterb]

Some KEMs have explicit failure modes for encapsulation/decapsulation. For instance, ML-KEM checks whether the encapsulation key is normalized. If it's not, encapsulation fails. We should spent some words on how to handle such cases. I'd say simply aborting, and sending an illegal_parameter alert. (ML-KEM doesn't have a similar check on the ciphertext except for its length.)