Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/tools/pki/crl_store.hpp

@@ -0,0 +1,45 @@
+#pragma once
+
+#include "hashed_id8.hpp"
+#include <vanetza/security/hashed_id.hpp>
+#include <vanetza/security/v3/revocation_lookup.hpp>
+#include <boost/optional/optional.hpp>
+#include <filesystem>
+#include <memory>
+#include <unordered_map>
+#include <unordered_set>
+
+namespace vanetza
+{
+namespace pki
+{
+
+class CertificateRevocationList;
+class SecurityModule;
+
+/**
+ * Constructor scans \p root and indexes every "*.crl" file.
+ * store() replaces any prior CRL from the same issuer (one file per issuer).
+ */
+class CrlFilesystemStore : public security::v3::RevocationLookup
+{
+public:
+    CrlFilesystemStore(std::shared_ptr<SecurityModule>, const std::filesystem::path& root);
+
+    // Returns false if the CRL has no extractable issuer or a malformed payload.
+    bool store(const CertificateRevocationList&);
+
+    bool is_revoked(const security::HashedId8& issuer, const security::HashedId8& cert) const override;
+
+protected:
+    std::filesystem::path filename(const HashedId8&) const;
+    boost::optional<HashedId8> index(const CertificateRevocationList&);
+
+private:
+    std::shared_ptr<SecurityModule> m_security;
+    std::filesystem::path m_root;
+    std::unordered_map<security::HashedId8, std::unordered_set<security::HashedId8>> m_revoked;
+};
+
+} // namespace pki
+} // namespace vanetza