refactor(mbedtls): use PSA API for auth_decrypt

This new version uses the multipart PSA AEAD API;
the authentication tag is verified via
a call to psa_aead_verify.

Change-Id: If4b7e6258223ae6fead1794d3e8d0004f0f387b3
Signed-off-by: Ryan Everett <ryan.everett@arm.com>