Fix AES SM MAC compare in unprotect()

[bahadirtmzr]

unprotect() is supposed to compare the first 8 bytes of the computed AES-CMAC with DO'8E.

It currently does this:

var CCb = mac(algoName: algoName, key: self.ksmac, msg: K)
if CCb.count > 8 {
    CCb = [UInt8](CC[0..<8])
}

CC is the MAC from the chip, so that assignment throws away the computed CMAC. AES-CMAC is 16 bytes, so we always take the branch and the compare becomes CC == CC. protect() already truncates CCb. The existing 3DES tests never hit this because DES MACs are already 8 bytes.

After PACE-AES or Chip Authentication AES, a response with one ciphertext byte flipped and the original MAC still unprotects.

testAESUnprotectRejectsModifiedCiphertext covers that case. testAESUnprotectAcceptsValidMAC checks a correctly MACed AES response still works.

The fix is the one assignment: truncate CCb, not CC.