Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/vanetza/security/tests/decap_service.cpp

@@ -0,0 +1,33 @@
+#include <gtest/gtest.h>
+#include <vanetza/common/its_aid.hpp>
+#include <vanetza/security/decap_service.hpp>
+#include <vanetza/security/v3/secured_message.hpp>
+
+#include "printer.hpp"
+
+using namespace vanetza;
+using namespace vanetza::security;
+
+TEST(DecapService, confirm_from_verify_confirm)
+{
+    v3::SecuredMessage v3_msg = v3::SecuredMessage::with_signed_data();
+    v3_msg.set_payload(ByteBuffer { 0xca, 0xfe });
+    SecuredMessage msg { std::move(v3_msg) };
+
+    const HashedId8 signer { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08 };
+    VerifyConfirm verify;
+    verify.report = VerificationReport::Success;
+    verify.its_aid = aid::CA;
+    verify.permissions = ByteBuffer { 0x01, 0x02 };
+    verify.certificate_validity = CertificateValidity::valid();
+    verify.certificate_id = signer;
+
+    DecapConfirm decap = DecapConfirm::from(std::move(verify), SecuredMessageView { msg });
+    EXPECT_EQ(VerificationReport::Success, decap.report);
+    EXPECT_EQ(aid::CA, decap.its_aid);
+    EXPECT_EQ(ByteBuffer({ 0x01, 0x02 }), decap.permissions);
+    EXPECT_TRUE(decap.certificate_validity);
+    ASSERT_TRUE(decap.certificate_id);
+    EXPECT_EQ(signer, *decap.certificate_id);
+    EXPECT_EQ(2, boost::apply_visitor([](const auto& packet) { return packet.size(); }, decap.plaintext_payload));
+}