Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/external/vanetza-idf/tools/certify-pqc/test_workflow.cmake

@@ -0,0 +1,105 @@
+if(NOT CERTIFY OR NOT CERTIFY_PQC OR NOT WORK_DIRECTORY)
+    message(FATAL_ERROR "CERTIFY, CERTIFY_PQC and WORK_DIRECTORY are required")
+endif()
+
+file(REMOVE_RECURSE "${WORK_DIRECTORY}")
+file(MAKE_DIRECTORY "${WORK_DIRECTORY}")
+
+function(run)
+    execute_process(
+        COMMAND ${ARGV}
+        WORKING_DIRECTORY "${WORK_DIRECTORY}"
+        RESULT_VARIABLE result
+        OUTPUT_VARIABLE output
+        ERROR_VARIABLE error)
+    if(NOT result EQUAL 0)
+        string(JOIN " " command ${ARGV})
+        message(FATAL_ERROR "Command failed (${result}): ${command}\n${output}${error}")
+    endif()
+endfunction()
+
+function(run_fails)
+    execute_process(
+        COMMAND ${ARGV}
+        WORKING_DIRECTORY "${WORK_DIRECTORY}"
+        RESULT_VARIABLE result
+        OUTPUT_VARIABLE output
+        ERROR_VARIABLE error)
+    if(result EQUAL 0)
+        string(JOIN " " command ${ARGV})
+        message(FATAL_ERROR "Command unexpectedly succeeded: ${command}\n${output}${error}")
+    endif()
+endfunction()
+
+function(check_show certificate material public_key_size signature_size)
+    execute_process(
+        COMMAND "${CERTIFY_PQC}" show "${certificate}"
+        WORKING_DIRECTORY "${WORK_DIRECTORY}"
+        RESULT_VARIABLE result
+        OUTPUT_VARIABLE output
+        ERROR_VARIABLE error)
+    if(NOT result EQUAL 0)
+        message(FATAL_ERROR "Cannot inspect ${certificate}:\n${output}${error}")
+    endif()
+
+    set(expectations
+        "Alternative material: ${material}"
+        "FN-DSA-512 public key: ${public_key_size} bytes"
+        "FN-DSA-512 signature: ${signature_size} bytes")
+    foreach(expectation IN LISTS expectations)
+        string(FIND "${output}" "${expectation}" position)
+        if(position EQUAL -1)
+            message(FATAL_ERROR
+                "Unexpected material in ${certificate}: missing '${expectation}'\n${output}")
+        endif()
+    endforeach()
+endfunction()
+
+run("${CERTIFY}" generate-key root.key)
+run("${CERTIFY}" generate-key aa.key)
+run("${CERTIFY}" generate-key ticket.key)
+run("${CERTIFY_PQC}" generate-key root)
+run("${CERTIFY_PQC}" generate-key aa)
+
+run("${CERTIFY_PQC}" generate-root
+    --profile ecc --output ecc-root.cert --subject-key root.key --days 365
+    --aid 36 141)
+run("${CERTIFY_PQC}" generate-aa
+    --profile ecc --output ecc-aa.cert
+    --sign-key root.key --sign-cert ecc-root.cert
+    --subject-key aa.key --days 180
+    --aid 36 141)
+run("${CERTIFY_PQC}" generate-ticket
+    --profile ecc --output ecc-ticket.cert
+    --sign-key aa.key --sign-cert ecc-aa.cert
+    --subject-key ticket.key --days 7
+    --aid 141)
+run("${CERTIFY_PQC}" verify-chain --profile ecc
+    --root ecc-root.cert --aa ecc-aa.cert --ticket ecc-ticket.cert --aid 141)
+check_show(ecc-root.cert "none" 0 0)
+check_show(ecc-aa.cert "none" 0 0)
+check_show(ecc-ticket.cert "none" 0 0)
+
+run("${CERTIFY_PQC}" generate-root
+    --output root.cert --subject-key root.key --subject-pqc-key root --days 365
+    --aid 36 141)
+run("${CERTIFY_PQC}" generate-aa
+    --output aa.cert
+    --sign-key root.key --sign-cert root.cert --sign-pqc-key root
+    --subject-key aa.key --subject-pqc-key aa --days 180
+    --aid 36 141)
+run("${CERTIFY_PQC}" generate-ticket
+    --output ticket.cert
+    --sign-key aa.key --sign-cert aa.cert --sign-pqc-key aa
+    --subject-key ticket.key --days 7
+    --aid 141)
+run("${CERTIFY_PQC}" verify-chain
+    --root root.cert --aa aa.cert --ticket ticket.cert --aid 141)
+check_show(root.cert "authority (key + signature)" 897 666)
+check_show(aa.cert "authority (key + signature)" 897 666)
+check_show(ticket.cert "end entity (signature only)" 0 666)
+
+run_fails("${CERTIFY_PQC}" verify-chain --profile hybrid
+    --root ecc-root.cert --aa ecc-aa.cert --ticket ecc-ticket.cert --aid 141)
+run_fails("${CERTIFY_PQC}" verify-chain --profile ecc
+    --root root.cert --aa aa.cert --ticket ticket.cert --aid 141)