Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/tools/socktap/certificate_validation_v3_pqc.cpp

@@ -0,0 +1,91 @@
+#include "certificate_validation_v3.hpp"
+#include <vanetza/security/persistence.hpp>
+#include <vanetza/security/pqc/fndsa512.hpp>
+#include <vanetza/security/pqc/hybrid_certificate_validator.hpp>
+#include <vanetza/security/v3/certificate.hpp>
+#include <vanetza/security/v3/issuer_memory_lookup.hpp>
+#include <vanetza/security/v3/trust_store.hpp>
+#include <boost/program_options.hpp>
+#include <stdexcept>
+
+namespace po = boost::program_options;
+
+namespace
+{
+
+class HybridCertificateValidationV3 : public CertificateValidationV3
+{
+public:
+    HybridCertificateValidationV3(
+        const vanetza::Runtime& runtime, vanetza::PositionProvider& positioning,
+        const vanetza::security::v3::LocationChecker& location_checker,
+        vanetza::security::Backend& ecc_backend) :
+        m_pqc_backend(vanetza::security::pqc::create_fndsa512_backend())
+    {
+        using Policy =
+            vanetza::security::pqc::HybridCertificateValidator::VerificationPolicy;
+        m_validator.use_runtime(&runtime);
+        m_validator.use_position_provider(&positioning);
+        m_validator.use_location_checker(&location_checker);
+        m_validator.use_issuer_lookup(&m_issuer_lookup);
+        m_validator.use_trust_store(&m_trust_store);
+        m_validator.use_backends(&ecc_backend, m_pqc_backend.get());
+        m_validator.use_verification_policy(Policy::HybridIfPresent);
+    }
+
+    vanetza::security::v3::CertificateValidator& validator() override
+    {
+        return m_validator;
+    }
+
+    vanetza::security::PrivateKey load_authorization_ticket_key(
+        const std::string& path) const override
+    {
+        return vanetza::security::load_private_key_from_der_file(path);
+    }
+
+    void add_chain_certificate(const vanetza::security::v3::Certificate& certificate) override
+    {
+        if (!m_issuer_lookup.insert(certificate)) {
+            throw std::invalid_argument(
+                "V3 certificate chain contains a certificate that cannot act as an issuer");
+        }
+        if (certificate.issuer_is_self()) {
+            m_trust_store.insert(certificate);
+        }
+    }
+
+private:
+    std::unique_ptr<vanetza::security::pqc::Backend> m_pqc_backend;
+    vanetza::security::v3::IssuerMemoryLookup m_issuer_lookup;
+    vanetza::security::v3::TrustStore m_trust_store;
+    vanetza::security::pqc::HybridCertificateValidator m_validator;
+};
+
+} // namespace
+
+std::unique_ptr<CertificateValidationV3> create_certificate_validation_v3(
+    const po::variables_map& options, const vanetza::Runtime& runtime,
+    vanetza::PositionProvider& positioning,
+    const vanetza::security::v3::LocationChecker& location_checker,
+    vanetza::security::Backend& backend)
+{
+    if (!options["enable-pqc-verification"].as<bool>()) {
+        return create_default_certificate_validation_v3(runtime, positioning, location_checker);
+    }
+    if (!options.count("certificate") || !options.count("certificate-chain")) {
+        throw std::invalid_argument(
+            "--enable-pqc-verification requires --certificate, --certificate-key, "
+            "and a trusted --certificate-chain");
+    }
+
+    return std::make_unique<HybridCertificateValidationV3>(
+        runtime, positioning, location_checker, backend);
+}
+
+void add_certificate_validation_v3_options(po::options_description& options)
+{
+    options.add_options()
+        ("enable-pqc-verification", po::bool_switch()->default_value(false),
+            "Verify hybrid PQC certificate signatures in an external V3 chain.");
+}