Add SUIT manifest verify + process support (off by default)

[aidangarske]

Optional SUIT manifest (draft-ietf-suit-manifest-34) secure update. Off by default (WOLFBOOT_SUIT); the TLV path is unchanged. See docs/SUIT.md.

Adds

• Parse + COSE_Sign1 verify (digest binding) + command interpreter (identity, image-match, write/copy install), via lib/wolfCOSE.
• Payload encryption on install (COSE_Encrypt0 / AES-GCM) — SUIT_HAVE_ENCRYPTION.
• Boot-time auto-dispatch (SUIT vs TLV detection, concatenated [envelope][image], A/B handoff).
• Security: anti-rollback (sequence number), image/component bounds, COSE kid key selection, device vendor/class identity.
• Networked update: directive-fetch via host callback (SUIT_HAVE_FETCH) + compact status report (SUIT_HAVE_REPORT).
• wolfBoot_suit_verify() API; pluggable component ops (reusable outside wolfBoot).

Tested (CI suit.yml): host author -> verify -> install -> encrypt -> fetch -> report -> tamper; independent interop cross-check (cbor2 + cryptography) of a frozen vector; WOLFBOOT_SUIT=1 sim build. Experimental, not yet hardware-tested.

Compliance: minimal trusted-invocation profile, codes verified vs IANA, default-deny on unsupported commands. Not full draft-34 (no severable / try-each / swap / dependencies).

Depends on wolfSSL/wolfCOSE #53 (submodule pinned to it).

Merge tasks

• Approve CI runs on this PR and the wolfCOSE PRs
• Merge wolfCOSE MPU: fix RO flag in flash preventing the update #53 (verify-only fixes) and tag v1.0
• Repin lib/wolfCOSE from MPU: fix RO flag in flash preventing the update #53 head to the v1.0 tag, then merge
• (Optional) Merge wolfCOSE Fixes to config and documentation for STM32WB #54 (downstream guard)

Production gate (before enabling WOLFBOOT_SUIT in a product)

• Fuzz the manifest parser + security review (manifest is attacker-controlled)
• Hardware-test the auto-dispatch + A/B swap path
• Provision the content-encryption key by key-wrap, not raw (encryption is not production-ready until then)
• Confirm anti-rollback sequence-number persistence on a SUIT-only boot