Release the lock in mbedtls_sha256_free if it was not released alread…

…y. Requires making pico_sha256_unlock include-able. Fixes raspberrypi#2103.

src/rp2_common/pico_mbedtls/pico_mbedtls.c

@@ -36,6 +36,9 @@ void mbedtls_sha256_init(__unused mbedtls_sha256_context *ctx) {
 }
 
 void mbedtls_sha256_free(__unused mbedtls_sha256_context *ctx) {
+    if (ctx->locked) {
+        pico_sha256_unlock(ctx);
+    }
 }
 
 int mbedtls_sha256_starts_ret(mbedtls_sha256_context *ctx, int is224) {

src/rp2_common/pico_sha256/include/pico/sha256.h

@@ -58,6 +58,16 @@ typedef struct pico_sha256_state {
     size_t total_data_size;
 } pico_sha256_state_t;
 
+/*! \brief Release the internal lock on the SHA256 hardware
+ *  \ingroup pico_sha256
+ *
+ * Release the internal lock on the hardware.
+ * Fails if the internal lock was not claimed.
+ *
+ * @param state A pointer to a pico_sha256_state_t instance
+ */
+void __weak pico_sha256_unlock(pico_sha256_state_t *state);
+
 /*! \brief Start a SHA-256 calculation returning immediately with an error if the SHA-256 hardware is not available
  *  \ingroup pico_sha256
  *