Crypto: Update to Mbed TLS 3.6.1

Update the CMake checkout dependency and re-align the
headers to the ones available in Mbed TLS 3.6.1.

Signed-off-by: Antonio de Angelis <antonio.deangelis@arm.com>
Change-Id: I681df1f2662c55b7aaf7eed2642b7ce3eeae8192
diff --git a/interface/include/mbedtls/check_config.h b/interface/include/mbedtls/check_config.h
index b3c038d..67a05f8 100644
--- a/interface/include/mbedtls/check_config.h
+++ b/interface/include/mbedtls/check_config.h
@@ -2,6 +2,13 @@
  * \file check_config.h
  *
  * \brief Consistency checks for configuration options
+ *
+ * This is an internal header. Do not include it directly.
+ *
+ * This header is included automatically by all public Mbed TLS headers
+ * (via mbedtls/build_info.h). Do not include it directly in a configuration
+ * file such as mbedtls/mbedtls_config.h or #MBEDTLS_USER_CONFIG_FILE!
+ * It would run at the wrong time due to missing derived symbols.
  */
 /*
  *  Copyright The Mbed TLS Contributors
@@ -12,6 +19,13 @@
 #define MBEDTLS_CHECK_CONFIG_H
 
 /* *INDENT-OFF* */
+
+#if !defined(MBEDTLS_CONFIG_IS_FINALIZED)
+#warning "Do not include mbedtls/check_config.h manually! " \
+         "This may cause spurious errors. " \
+         "It is included automatically at the right point since Mbed TLS 3.0."
+#endif /* !MBEDTLS_CONFIG_IS_FINALIZED */
+
 /*
  * We assume CHAR_BIT is 8 in many places. In practice, this is true on our
  * target platforms, so not an issue, but let's just be extra sure.