Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/external/vanetza-idf/docs/idf/evidence/security-host-09/result.json

@@ -0,0 +1,64 @@
+{
+  "started_utc": "2026-09-14T13:59:32.471237+00:00",
+  "binary_sha256": "6d7f18b24b0dd2e8553e18bfc6fd800b9c777ae7eabb3dc491a6945e9d1bff21",
+  "config_sha256": "9738ccbe1d5b82bb9dea0b2c5bcd55a42769c9b01a0ce51e97b7e46744755d98",
+  "sut_sha256": "0c7296b2a6190d3213545c95badd6eb37b805f814b5f912b1399b01525c78682",
+  "sut_args": "--security-pool ./certificates",
+  "pool_sha256": {
+    "CERT_IUT_A_AA.oer": "c57f652cfee53541558898b4ad1f0429ffd305bac015edfd87e5d18581e8dbd7",
+    "CERT_IUT_A_AA.vkey": "0bc19b4d25380a7856de9f02c82a1759863c82dec66591e7d709d3a0b9d90c4d",
+    "CERT_IUT_A_AT.oer": "684c733386dc2a91b191693809efd2fcc5339409e51b8dbaba1862d0e89fe341",
+    "CERT_IUT_A_AT.vkey": "c29c830a2e5246b5cac2b50b9a00c0bed95b322cac93688f6ad4c0f495e99500",
+    "CERT_IUT_A_RCA.oer": "46fba5281baedd9e34dabcf3cebebc0dc37ed2fb9a271eeaac1311d9e9d64a52",
+    "CERT_IUT_A_RCA.vkey": "b2db542a5d298d6064786d4cce5626d407fcaa8637646d60b0173e77d566b074",
+    "CERT_TS_A_AA.oer": "6c50c4963552b4fde3d3348c5ace66f7cbfd5f05955b5217639472907c14e87e",
+    "CERT_TS_A_AA.vkey": "36bd2c8720fb58cf7a857ac64962dc40423bdeef607abf46f84a885320546718",
+    "CERT_TS_A_AT.oer": "6fd5364867510d2816f1dc3c271779022c9621bf50b642831ebe5b82304922bc",
+    "CERT_TS_A_AT.vkey": "c9807794d77687d594cd43937f7f59ee14399182b30f2b6c95fad8dea476518a",
+    "CERT_TS_B_AT.oer": "047d8ae99e07950ae4210ce272bc4ef94e738f230619522ce38ba5d7a7ff2898",
+    "CERT_TS_B_AT.vkey": "9959751d735d6c3ee3b2471cdd17871a1c3b53b2cb0a919288a97a12c087bcf8",
+    "index.lst": "0f9b7820065ef40e5a0b8ac02c0d319c5d1f5348d05223541a7756a217bb804b"
+  },
+  "expected_cases_sha256": "c5e35af30dd9e246d5f6b93d43ccfede92690389f955cd0eb1d4bdb0a28cef23",
+  "verdicts": [
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_01_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_02_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_03_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_04_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_05_BV",
+      "verdict": "fail"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_06_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_07_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_08_BV",
+      "verdict": "pass"
+    }
+  ],
+  "status": "completed",
+  "exit_code": 0,
+  "missing_cases": [],
+  "unexpected_cases": [],
+  "duplicate_cases": [],
+  "campaign_complete": true,
+  "finished_utc": "2026-09-14T14:00:06.801845+00:00"
+}