Constrain file store decoders to the caller's provider boundary

Summary

The wolfProvider file store fetched its terminal decoders using only the
structure property and ignored the caller's property query, so a store load
routed to wolfProvider could add and use a decoder from another provider. This
PR propagates the caller's property query into those explicit fetches so a
provider=wolfprov boundary is honored consistently. Fixes finding f_5534.

Problem

wp_file_set_decoder() fetched each decoder like this:

decoder = OSSL_DECODER_fetch(ctx->provCtx->libCtx, wp_decoders[i].name,
    wp_decoders[i].propQuery);   /* e.g. "structure=PrivateKeyInfo" */

The caller-supplied ctx->propQuery (where an application expresses a
provider=wolfprov compliance boundary via OSSL_STORE_PARAM_PROPERTIES) was
applied only to OSSL_DECODER_CTX_add_extra, not to these explicit fetches.
As a result the store's own terminal decoders were fetched without any provider
constraint and could resolve to another provider's implementation.

Fix

Add a file-local helper that combines each decoder's structure query with the
caller's property query, and use it for every explicit fetch:

static int wp_file_decoder_prop_query(const char* base, const char* caller,
    char** query);   /* 1 = ok, 0 = alloc failure; *query freed by caller */

• No caller query (NULL) → behavior unchanged ("structure=...").
• provider=wolfprov → combined query ("structure=...,provider=wolfprov"),
  so the boundary applies to the explicit fetches as well as to
  OSSL_DECODER_CTX_add_extra.

Behavior / compatibility

• Default behavior (no property query) is unchanged.
• When the caller sets provider=wolfprov, the boundary is now enforced on all
  of the store's decoder fetches. A load that previously resolved silently
  through another provider will now stay within wolfProvider — or fail if
  wolfProvider cannot satisfy it, which is the intended boundary semantics.

Testing

• Builds clean under the project's strict warning set
  (-Werror -Wextra -Wshadow -Wshorten-64-to-32 ...).
• Full unit suite passes (OPENSSL_CONF=provider.conf), including the
  store-load paths: test_rsa_load_key, test_rsa_load_cert,
  test_ec_load_key, test_ec_load_cert.