mbedtls: 3.5.2 -> 3.6.0

Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.6.0
Fixes CVE-2024-28960

pkgs/development/libraries/mbedtls/3.nix

···
-{ callPackage }:
+{ callPackage
+, fetchpatch
+}:
 
 callPackage ./generic.nix {
-  version = "3.5.2";
-  hash = "sha256-lVGmnSYccNmRS6vfF/fDiny5cYRPc/wJBpgciFLPUvM=";
+  version = "3.6.0";
+  hash = "sha256-tCwAKoTvY8VCjcTPNwS3DeitflhpKHLr6ygHZDbR6wQ=";
+
+  patches = [
+    # https://github.com/Mbed-TLS/mbedtls/pull/9000
+    # Remove at next version update
+    (fetchpatch {
+      name = "fix-darwin-memcpy-error.patch";
+      url = "https://github.com/Mbed-TLS/mbedtls/commit/b32d7ae0fee2f906be59780b42a0cd4468a39bd1.patch";
+      hash = "sha256-BTkJs9NEkCl+/Q8EwB/LW9uwF95jQOKWmoCK4B/7/sU=";
+    })
+  ];
 }

pkgs/development/libraries/mbedtls/generic.nix

···
 , stdenv
 , version
 , hash
+, patches ? []
 , fetchFromGitHub
 
 , cmake
···
     # mbedtls >= 3.6.0 uses git submodules
     fetchSubmodules = true;
   };
+
+  inherit patches;
 
   nativeBuildInputs = [ cmake ninja perl python3 ];