Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/docs/tools/certify.md

@@ -0,0 +1,47 @@
+# Certify
+
+*Certify* is a tool to create and view certificates and can be used to set up a test PKI for secured V2X communication based on TS 103 097 v1.2.1.
+
+## Installation
+
+You need to enable building this tool explicitly.
+Run `cmake -D BUILD_CERTIFY=ON ..` in your build directory and rebuild Vanetza.
+You should be able to find `bin/certify` in your build directory afterwards.
+
+## PKI Setup
+
+The following section describe how to setup a test PKI.
+We will generate a root certificate, an authorization authority certificate and an authorization ticket.
+
+### Generating Keys
+
+New private keys can be generated using `bin/certify generate-key root.key`.
+The corresponding public key can be extracted using `bin/certify extract-public-key --private-key root.key root.pub`, but this step usually isn't required.
+
+Please generate a `root.key` for the root certificate, a `aa.key` for the authorization authority and a `ticket.key` for the authorization ticket.
+
+### Generating Root Certificates
+
+A root certificate can be generated using `bin/certify generate-root --subject-key root.key root.cert`.
+
+### Generating Authorization Authorities
+
+An authorization authority certificate can be generated using `bin/certify generate-aa --sign-key root.key --sign-cert root.cert --subject-key aa.key aa.cert`.
+
+### Generating Authorization Tickets
+
+An authorization ticket can be generated using `bin/certify generate-ticket --sign-key aa.key --sign-cert aa.cert --subject-key ticket.key ticket.cert`.
+
+If you're generating a certificate for real V2X hardware, it will likely use a hardware security module (HSM), which will only expose the public key.
+You can export the given public key to a file and use `--subject-key` also with public keys.
+The public key needs to be encoded according to the rules specified by ETSI in TS 103 097 v1.2.1.
+
+## Other Options
+
+This guide only uses the required options.
+Further options may be available for certain commands.
+Use `bin/certify <command> --help` for further information.
+
+## Acknowledgement
+
+This application has been initially developed [Niklas Keller](https://github.com/kelunik).