Keep the colleague's microbu-esp32c5 tree in this repository

obu-firmware builds against vanetza-idf from microbu-esp32c5/external, but
that tree was gitignored, so a clone of this repository could not build the
firmware it ships. It is now committed here as ordinary files in its own
folder, microbu-esp32c5/: the colleague's commit cf4b99f plus the V2X2MAP
bridge's signature verification (--trust) used on the bench. Nothing is
fetched from or pushed to the colleague's repository; this repository and
its remotes carry everything. The folder's own .gitignore keeps build output,
downloaded components and private key material out, as it did there; the
committed file set is identical to that repository's tracked files.

The ESP32-C5 is still flashed from obu-firmware/, which only takes
vanetza-idf from microbu-esp32c5/, so the two stay separate folders.
FLASHING.md says how to take a newer version of the colleague's tree (copy
it over the folder, rebuild, test, commit).

microbu-esp32c5/firmware/CMakeLists.txt

@@ -0,0 +1,45 @@
+cmake_minimum_required(VERSION 3.22)
+# micrOBU firmware: the ESP32-C5 half of the VRU ITS-S on the external vanetza-idf component
+# (tracked directly in this repository at external/vanetza-idf; see external/vanetza-idf/PROVENANCE.md).
+
+# Provenance guard for main/otm_tx_custom.c (implementation/provenance/adapted-code.yaml, key
+# otm-c5-radio-tx-custom): this checked-in copy -- not the vanetza-idf submodule's own
+# radio_c5.cmake-generated one, which builds into vanetza_idf::C5Radio, a class this firmware
+# never references -- is what microbu::C5Radio::request() and C5Radio::transmit_burst() actually
+# link against for every over-the-air transmission. Fail configure if either the pinned upstream
+# (when the nested OTM submodule is checked out) or this file drifts from the reviewed revision,
+# so a silent edit to either can no longer pass unnoticed the way it previously could.
+set(_otm_upstream "${CMAKE_CURRENT_LIST_DIR}/../external/vanetza-idf/ports/esp_idf/third_party/otm/main/tx_custom.c")
+if(EXISTS "${_otm_upstream}")
+    file(READ "${_otm_upstream}" _otm_upstream_text)
+    string(REPLACE "\r\n" "\n" _otm_upstream_text "${_otm_upstream_text}")
+    string(SHA256 _otm_upstream_hash "${_otm_upstream_text}")
+    if(NOT _otm_upstream_hash STREQUAL "cb1dccfef96912ca59275e8a9102f41f56925b94a19d4a4629082aaeb779be1b")
+        message(FATAL_ERROR "OpenTrafficMap upstream tx_custom.c (nested submodule third_party/otm) differs from the reviewed source revision (674e3412) -- review before updating main/otm_tx_custom.c and this hash")
+    endif()
+endif()
+set(_otm_checked_in "${CMAKE_CURRENT_LIST_DIR}/main/otm_tx_custom.c")
+file(READ "${_otm_checked_in}" _otm_checked_in_text)
+string(REPLACE "\r\n" "\n" _otm_checked_in_text "${_otm_checked_in_text}")
+string(SHA256 _otm_checked_in_hash "${_otm_checked_in_text}")
+if(NOT _otm_checked_in_hash STREQUAL "114693af99ce3866cfc767066d484e45822eaf15335d94a03626b60ac5777277")
+    message(FATAL_ERROR "main/otm_tx_custom.c differs from the reviewed copy -- update implementation/provenance/adapted-code.yaml (key otm-c5-radio-tx-custom) and this hash after reviewing the change")
+endif()
+
+list(APPEND EXTRA_COMPONENT_DIRS "${CMAKE_CURRENT_LIST_DIR}/../external/vanetza-idf")
+set(SDKCONFIG_DEFAULTS "${CMAKE_CURRENT_LIST_DIR}/sdkconfig.defaults")
+set(COMPONENTS main)
+include($ENV{IDF_PATH}/tools/cmake/project.cmake)
+project(microbu_firmware)
+add_compile_options(-Wno-error -Wno-cpp -Wno-error=implicit-function-declaration)
+idf_component_get_property(vanetza_lib vanetza-idf COMPONENT_LIB)
+if(vanetza_lib)
+    target_compile_options(${vanetza_lib} PRIVATE -Wno-error=implicit-function-declaration -Wno-error=cpp)
+endif()
+# GCC 15's stricter -Warray-bounds false-positives on NimBLE's fixed-size bond-store arrays
+# (upstream Apache Mynewt code, not ours); demote to a warning so the component still builds.
+idf_component_get_property(bt_lib bt COMPONENT_LIB)
+if(bt_lib)
+    target_compile_options(${bt_lib} PRIVATE -Wno-error=array-bounds)
+endif()
+