Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/docs/idf/evidence/security-host-09/result.json

@@ -0,0 +1,64 @@
+{
+  "started_utc": "2026-09-14T13:59:32.471237+00:00",
+  "binary_sha256": "6d7f18b24b0dd2e8553e18bfc6fd800b9c777ae7eabb3dc491a6945e9d1bff21",
+  "config_sha256": "9738ccbe1d5b82bb9dea0b2c5bcd55a42769c9b01a0ce51e97b7e46744755d98",
+  "sut_sha256": "0c7296b2a6190d3213545c95badd6eb37b805f814b5f912b1399b01525c78682",
+  "sut_args": "--security-pool ./certificates",
+  "pool_sha256": {
+    "CERT_IUT_A_AA.oer": "c57f652cfee53541558898b4ad1f0429ffd305bac015edfd87e5d18581e8dbd7",
+    "CERT_IUT_A_AA.vkey": "0bc19b4d25380a7856de9f02c82a1759863c82dec66591e7d709d3a0b9d90c4d",
+    "CERT_IUT_A_AT.oer": "684c733386dc2a91b191693809efd2fcc5339409e51b8dbaba1862d0e89fe341",
+    "CERT_IUT_A_AT.vkey": "c29c830a2e5246b5cac2b50b9a00c0bed95b322cac93688f6ad4c0f495e99500",
+    "CERT_IUT_A_RCA.oer": "46fba5281baedd9e34dabcf3cebebc0dc37ed2fb9a271eeaac1311d9e9d64a52",
+    "CERT_IUT_A_RCA.vkey": "b2db542a5d298d6064786d4cce5626d407fcaa8637646d60b0173e77d566b074",
+    "CERT_TS_A_AA.oer": "6c50c4963552b4fde3d3348c5ace66f7cbfd5f05955b5217639472907c14e87e",
+    "CERT_TS_A_AA.vkey": "36bd2c8720fb58cf7a857ac64962dc40423bdeef607abf46f84a885320546718",
+    "CERT_TS_A_AT.oer": "6fd5364867510d2816f1dc3c271779022c9621bf50b642831ebe5b82304922bc",
+    "CERT_TS_A_AT.vkey": "c9807794d77687d594cd43937f7f59ee14399182b30f2b6c95fad8dea476518a",
+    "CERT_TS_B_AT.oer": "047d8ae99e07950ae4210ce272bc4ef94e738f230619522ce38ba5d7a7ff2898",
+    "CERT_TS_B_AT.vkey": "9959751d735d6c3ee3b2471cdd17871a1c3b53b2cb0a919288a97a12c087bcf8",
+    "index.lst": "0f9b7820065ef40e5a0b8ac02c0d319c5d1f5348d05223541a7756a217bb804b"
+  },
+  "expected_cases_sha256": "c5e35af30dd9e246d5f6b93d43ccfede92690389f955cd0eb1d4bdb0a28cef23",
+  "verdicts": [
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_01_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_02_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_03_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_04_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_05_BV",
+      "verdict": "fail"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_06_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_07_BV",
+      "verdict": "pass"
+    },
+    {
+      "testcase": "TC_SEC_ITSS_SND_GENMSG_08_BV",
+      "verdict": "pass"
+    }
+  ],
+  "status": "completed",
+  "exit_code": 0,
+  "missing_cases": [],
+  "unexpected_cases": [],
+  "duplicate_cases": [],
+  "campaign_complete": true,
+  "finished_utc": "2026-09-14T14:00:06.801845+00:00"
+}