[aes/rtl] Don't feed zero into cipher output unmasking logic
[aes/rtl] Don't feed zero into cipher output unmasking logic

Previously, we were feeding zero into the cipher output unmasking logic
to avoid leaking intermediate state whenever the cipher core output
isn't valid. However, this may still leak information on the final
cipher core output when it becomes valid. To avoid that, this commit
feeds different PRD for both shares into the unmasking logic whenever
the output isn't valid.

Signed-off-by: Pirmin Vogel <386a7fc8e7338ed7899b4d9883c0ebec5de81366@lowrisc.org>

lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan