wolfHSM server support + cert chain auth

[bigbrett]

• Adds wolfHSM server support for wolfBoot (previously wolfHSM support used the client API) for x509 cert chain auth
• Updates CI tests to use new in-tree wolfHSM example server instead of separate examples repo
• Adds explicit SPMATH=1 to config due to wolfHSM build errors from upstream wolfCrypt changes
• Updates documentation

This PR also should fix CI failures due to wolfCrypt WC_RNG HAVE_GETPID change

[Copilot]

Pull Request Overview

This PR refactors wolfHSM integration in wolfBoot by adding native server support and certificate chain authentication while updating related CI tests and build configurations. Key changes include:

• Migrating from dedicated wolfHSM client objects to a unified WOLFHSM_OBJS usage and conditional handling for client/server modes.
• Adding new HAL functions for initializing and cleaning up the wolfHSM server.
• Updating documentation and CI workflows to reflect the new server mode and cert chain verification support.

Reviewed Changes

Copilot reviewed 23 out of 23 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
test-app/Makefile	Updated object lists to use unified WOLFHSM_OBJS in client and server configurations.
src/update_*.c	Adjusted calls to hsm disconnect/cleanup functions based on client/server configuration.
src/loader.c	Added wolfHSM server init block alongside client initialization.
src/image.c	Expanded conditionals for signature verification to support both client/server modes.
options.mk	Separated wolfHSM client and server option blocks with corresponding object and flag changes.
include/user_settings.h & include/hal.h	Updated macros and external declarations for unified HSM identifiers and functions.
hal/sim.c & hal/aurix_tc3xx.c	Refactored HSM context variables and initialization routines.
docs/*	Updated documentation to cover both wolfHSM client and server modes along with cert chain auth.
config/examples/*, arch.mk, Makefile, workflows	Adjustments to build configurations and CI workflows to support the new server mode.

Comments suppressed due to low confidence (2)

src/image.c:274

• The default fallback for ECC key assignment only handles the client mode. Consider adding explicit handling for server mode (when certificate chain verification is not active) to ensure consistent key assignment across configurations.

            ret = wh_Client_EccSetKeyId(&ecc, hsmKeyIdPubKey);

Makefile:70

• [nitpick] Include or update a comment explaining the transition from WOLFHSM_CLIENT_OBJS to a unified WOLFHSM_OBJS to help maintain clarity as to how client and server modes are handled.

OBJS+=$(WOLFHSM_OBJS)