Add SUIT manifest verify + process support (off by default)

[aidangarske]

Adds optional SUIT manifest (draft-ietf-suit-manifest-34) verification and processing, gated behind WOLFBOOT_SUIT and off by default. The native TLV image path is unchanged when it is not enabled. SUIT is the richer, standards-based path for networked secure update (wolfUpdate); the lean TLV path stays the default for plain secure boot. See docs/SUIT.md.

What it does

• suit_open — parse the SUIT_Envelope + manifest (zero-copy).
• suit_verify_auth — COSE_Sign1 (via the lib/wolfCOSE submodule) over the detached SUIT_Digest, then a distinct binding of that digest to hash(manifest).
• suit_process — command-sequence interpreter: identity conditions (vendor/class), image-match, and install directives (write/copy), with default-deny on any command it does not implement.
• wolfBoot_suit_verify() — entry point; storage access is via pluggable suit_component_ops (flash on target), which also keeps the processor reusable outside wolfBoot.

Testing (A → B → C, in CI via .github/workflows/suit.yml)

• A: host test authors a full signed envelope with wolfCOSE and runs the whole chain (parse, verify, identity-validate, install, image-match) plus tamper/corruption/wrong-identity cases.
• B: independent cross-check of the authored envelope with non-wolfCOSE tooling (cbor2 + cryptography, RFC 9052 Sig_structure) — interop, not self-agreement.
• C: a frozen, committed vector (tests/vectors/suit_envelope.cbor) validated by the cross-check.
• The CI also builds the WOLFBOOT_SUIT=1 sim against a verify-only wolfCrypt.

Compliance

Format-compliant minimal "trusted invocation" profile; all integer codes verified against the IANA SUIT registry, default-deny on unsupported commands, interop cross-checked. Not a full draft-34 implementation (no fetch, severable members, try-each/swap/run-sequence, dependencies, reports).

Dependency / sequencing

Depends on the wolfCOSE verify-only fixes (wolfSSL/wolfCOSE #53). The lib/wolfCOSE submodule is pinned to that work; repin to the wolfCOSE v1.0 tag before merge.

Follow-ups

A/B-swap auto-dispatch from wolfBoot_verify_authenticity, and payload encryption (COSE_Encrypt0) for confidentiality.