Fix ML-KEM constant-time validation regression

https://boringssl-review.googlesource.com/c/boringssl/+/92828
declassified the result of (s0 | s1) >= kPrime, but that is not the same
as s0 >= kPrime || s1 >= kPrime. Instead, just write this more
straightforwardly.

Change-Id: I68e12a38d074db754daf46d60bb061d80a95f2da
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/98108
Auto-Submit: David Benjamin <davidben@google.com>
Commit-Queue: Xiangfei Ding <xfding@google.com>
Presubmit-BoringSSL-Verified: boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>

crypto/fipsmodule/mlkem/mlkem.cc.inc

diff --git a/crypto/fipsmodule/mlkem/mlkem.cc.inc b/crypto/fipsmodule/mlkem/mlkem.cc.inc
index a73d5d9..6c84160 100644
--- a/crypto/fipsmodule/mlkem/mlkem.cc.inc
+++ b/crypto/fipsmodule/mlkem/mlkem.cc.inc
@@ -741,10 +741,11 @@
   for (int i = 0; i < DEGREE; i += 2) {
     uint16_t s0 = (uint16_t)(in[0] | ((in[1] & 0x0f) << 8));
     uint16_t s1 = (uint16_t)((in[1] >> 4) | (in[2] << 4));
-    if (constant_time_declassify_int((s0 | s1) >= kPrime)) {
-      if (s0 >= kPrime || s1 >= kPrime) {
-        return 0;
-      }
+    // This is only used with secret input when parsing the test-only
+    // semi-expanded format. Leaking information about invalid inputs is OK.
+    if (constant_time_declassify_int(s0 >= kPrime) ||
+        constant_time_declassify_int(s1 >= kPrime)) {
+      return 0;
     }
     out->c[i] = s0;
     out->c[i + 1] = s1;