Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/tools/pki/tests/stub_certificate.hpp

@@ -0,0 +1,58 @@
+#pragma once
+
+#include "asn1.hpp"
+#include "certificate.hpp"
+#include "keys.hpp"
+#include <vanetza/asn1/asn1c_wrapper.hpp>
+#include <vanetza/asn1/security/EtsiTs103097Certificate.h>
+#include <vanetza/common/clock.hpp>
+#include <vanetza/security/v3/basic_elements.hpp>
+#include <chrono>
+#include <cstdlib>
+
+namespace vanetza
+{
+namespace pki
+{
+
+// Minimal certificate built around a given verification key (and optional
+// encryption key). Not TS-compliant (no issuer chain, no permissions, no
+// signature) but just enough that get_public_key/get_encryption_key return our
+// keys and the cert OER-encodes so calculate_hashed_id8 is stable. Intended
+// for unit tests where the cert only needs to act as a key holder + digest
+// source.
+inline Certificate build_stub_certificate(const PublicKey& verify_key, const PublicKey* encryption_key = nullptr,
+    Clock::time_point valid_since = Clock::time_point {}, std::chrono::hours validity = std::chrono::hours(24))
+{
+    asn1::asn1c_oer_wrapper<Vanetza_Security_EtsiTs103097Certificate_t>
+        cert(asn_DEF_Vanetza_Security_EtsiTs103097Certificate);
+    cert->version = 3;
+    cert->type = Vanetza_Security_CertificateType_explicit;
+    cert->issuer.present = Vanetza_Security_IssuerIdentifier_PR_self;
+    cert->issuer.choice.self = Vanetza_Security_HashAlgorithm_sha256;
+
+    auto& tbs = cert->toBeSigned;
+    tbs.id.present = Vanetza_Security_CertificateId_PR_name;
+    OCTET_STRING_fromBuf(&tbs.id.choice.name, "test-cert", 9);
+    tbs.cracaId.buf = static_cast<uint8_t*>(std::calloc(3, 1));
+    tbs.cracaId.size = 3;
+    tbs.crlSeries = 0;
+    tbs.validityPeriod.start = security::v3::convert_time32(valid_since);
+    tbs.validityPeriod.duration.present = Vanetza_Security_Duration_PR_hours;
+    tbs.validityPeriod.duration.choice.hours = validity.count();
+    tbs.verifyKeyIndicator.present = Vanetza_Security_VerificationKeyIndicator_PR_verificationKey;
+    set_verification_key(tbs.verifyKeyIndicator.choice.verificationKey, verify_key);
+
+    if (encryption_key) {
+        tbs.encryptionKey = asn1::allocate<Vanetza_Security_PublicEncryptionKey_t>();
+        set_encryption_key(*tbs.encryptionKey, *encryption_key);
+    }
+
+    Certificate result;
+    ByteBuffer encoded = cert.encode();
+    result.decode(encoded);
+    return result;
+}
+
+} // namespace pki
+} // namespace vanetza