Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/external/vanetza-idf/vanetza/security/v3/certificate_validator.hpp

@@ -0,0 +1,97 @@
+#pragma once
+#include <vanetza/common/its_aid.hpp>
+#include <vanetza/security/v3/location_checker.hpp>
+
+namespace vanetza
+{
+
+// forward declarations
+class PositionProvider;
+class Runtime;
+
+namespace security
+{
+namespace v3
+{
+
+// forward declarations
+class Certificate;
+class CertificateView;
+class IssuerLookup;
+class RevocationLookup;
+class TrustStore;
+
+class CertificateValidator
+{
+public:
+    enum class Verdict
+    {
+        Unknown,
+        Valid,
+        Expired,
+        Revoked,
+        Untrusted,
+        InconsistentChain,
+        OutsideRegion,
+        InsufficientPermission,
+        Misconfiguration,
+    };
+
+    /**
+     * Check if a certificate can be used for signing a message
+     * \param certificate pre-validated AT certificate
+     * \param app ITS-AID of the message to be signed
+     */
+    virtual Verdict valid_for_signing(const CertificateView& certificate, ItsAid app) = 0;
+
+    virtual ~CertificateValidator() = default;
+};
+
+class DefaultCertificateValidator : public CertificateValidator
+{
+public:
+    Verdict valid_for_signing(const CertificateView&, ItsAid) override;
+    
+    void use_runtime(const Runtime* runtime);
+    void use_position_provider(PositionProvider* provider);
+    void use_issuer_lookup(const IssuerLookup* lookup);
+    void use_location_checker(const LocationChecker* checker);
+    void use_revocation_lookup(const RevocationLookup* lookup);
+    void use_trust_store(const TrustStore* store);
+
+    void disable_time_checks(bool flag);
+    void disable_location_checks(bool flag);
+    void disable_chain_consistency_checks(bool flag);
+    void disable_region_consistency_checks(bool flag);
+
+private:
+    const Certificate* find_issuer_certificate(const CertificateView& certificate) const;
+    bool chain_is_consistent(const CertificateView& signing_cert, ItsAid its_aid) const;
+    bool chain_is_revoked(const CertificateView& signing_cert) const;
+    bool check_consistency(const CertificateView& subject, const CertificateView& issuer, ItsAid its_aid) const;
+    bool is_chain_anchored(const CertificateView& signing_cert) const;
+
+    const Runtime* m_runtime = nullptr;
+    PositionProvider* m_position_provider = nullptr;
+    const IssuerLookup* m_issuer_lookup = nullptr;
+    const LocationChecker* m_location_checker = nullptr;
+    const RevocationLookup* m_revocation_lookup = nullptr;
+    const TrustStore* m_trust_store = nullptr;
+    bool m_disable_time_checks = false;
+    bool m_disable_location_checks = false;
+    bool m_disable_chain_consistency_checks = false;
+    bool m_disable_region_consistency_checks = false;
+};
+
+class NullCertificateValidator : public CertificateValidator
+{
+public:
+    Verdict valid_for_signing(const CertificateView&, ItsAid) override
+    {
+        return Verdict::Valid;
+    }
+};
+
+} // namespace v3
+} // namespace security
+} // namespace vanetza