Keep vanetza-idf in obu-firmware, so a plain clone builds the firmware

obu-firmware builds against the vanetza-idf C-ITS library, which until now
came from the colleague's microbu-esp32c5 tree beside the repository and was
not tracked here, so a clone of this repository could not build the firmware
it ships. The library alone is now part of obu-firmware, as
obu-firmware/external/vanetza-idf: their external/vanetza-idf at commit
cf4b99f, unchanged (9775 files; see its PROVENANCE.md). CMake takes it from
there by default; -DVANETZA_IDF_DIR still points the build elsewhere.

The rest of the colleague's tree (their own VAM firmware, PKI tooling,
station-link Python tools, the V2X2MAP bridge) stays out of this repository
and gitignored; nothing is pushed to their repository. NOTES.md, docs/06,
TODO.md and the pcap verifier's usage line point at the new location.

obu-firmware/external/vanetza-idf/vanetza/security/v3/certificate_validator.hpp

@@ -0,0 +1,97 @@
+#pragma once
+#include <vanetza/common/its_aid.hpp>
+#include <vanetza/security/v3/location_checker.hpp>
+
+namespace vanetza
+{
+
+// forward declarations
+class PositionProvider;
+class Runtime;
+
+namespace security
+{
+namespace v3
+{
+
+// forward declarations
+class Certificate;
+class CertificateView;
+class IssuerLookup;
+class RevocationLookup;
+class TrustStore;
+
+class CertificateValidator
+{
+public:
+    enum class Verdict
+    {
+        Unknown,
+        Valid,
+        Expired,
+        Revoked,
+        Untrusted,
+        InconsistentChain,
+        OutsideRegion,
+        InsufficientPermission,
+        Misconfiguration,
+    };
+
+    /**
+     * Check if a certificate can be used for signing a message
+     * \param certificate pre-validated AT certificate
+     * \param app ITS-AID of the message to be signed
+     */
+    virtual Verdict valid_for_signing(const CertificateView& certificate, ItsAid app) = 0;
+
+    virtual ~CertificateValidator() = default;
+};
+
+class DefaultCertificateValidator : public CertificateValidator
+{
+public:
+    Verdict valid_for_signing(const CertificateView&, ItsAid) override;
+    
+    void use_runtime(const Runtime* runtime);
+    void use_position_provider(PositionProvider* provider);
+    void use_issuer_lookup(const IssuerLookup* lookup);
+    void use_location_checker(const LocationChecker* checker);
+    void use_revocation_lookup(const RevocationLookup* lookup);
+    void use_trust_store(const TrustStore* store);
+
+    void disable_time_checks(bool flag);
+    void disable_location_checks(bool flag);
+    void disable_chain_consistency_checks(bool flag);
+    void disable_region_consistency_checks(bool flag);
+
+private:
+    const Certificate* find_issuer_certificate(const CertificateView& certificate) const;
+    bool chain_is_consistent(const CertificateView& signing_cert, ItsAid its_aid) const;
+    bool chain_is_revoked(const CertificateView& signing_cert) const;
+    bool check_consistency(const CertificateView& subject, const CertificateView& issuer, ItsAid its_aid) const;
+    bool is_chain_anchored(const CertificateView& signing_cert) const;
+
+    const Runtime* m_runtime = nullptr;
+    PositionProvider* m_position_provider = nullptr;
+    const IssuerLookup* m_issuer_lookup = nullptr;
+    const LocationChecker* m_location_checker = nullptr;
+    const RevocationLookup* m_revocation_lookup = nullptr;
+    const TrustStore* m_trust_store = nullptr;
+    bool m_disable_time_checks = false;
+    bool m_disable_location_checks = false;
+    bool m_disable_chain_consistency_checks = false;
+    bool m_disable_region_consistency_checks = false;
+};
+
+class NullCertificateValidator : public CertificateValidator
+{
+public:
+    Verdict valid_for_signing(const CertificateView&, ItsAid) override
+    {
+        return Verdict::Valid;
+    }
+};
+
+} // namespace v3
+} // namespace security
+} // namespace vanetza