Support stm32h5 TrustZone build via CMake

[mattia-moffa]

Fixes part of ZD#20700

[Copilot]

Pull request overview

Adds CMake support to build STM32H5 (and STM32L5) TrustZone configurations, including generating/consuming the non-secure import library and wiring in TrustZone/PKCS11 build options.

Changes:

• Add STM32H5/STM32L5 target handling (CPU flags, linker scripts, and test-app sources) including TrustZone-specific paths.
• Introduce TrustZone build plumbing: -mcmse flags, CMSE import library generation (wc_secure_calls.o), and non-secure test-app linking behavior.
• Extend wolfCrypt source selection for WOLFCRYPT_TZ_PKCS11 and update the stm32h5 preset variables accordingly.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test-app/CMakeLists.txt	Adds stm32h5/stm32l5 linker scripts and TrustZone/PKCS11-specific sources/linking for the test app.
lib/CMakeLists.txt	Adds conditional wolfCrypt sources needed when building with WOLFCRYPT_TZ_PKCS11.
cmake/wolfboot.cmake	Declares wc_secure_calls.o as a post-build byproduct and passes IMAGE_HEADER_SIZE via environment when signing.
cmake/toolchain_arm-none-eabi.cmake	Maps stm32h5/stm32l5 to Cortex-M33 CPU flags.
CMakePresets.json	Updates stm32h5 preset defaults for TrustZone/PKCS11 and partition addresses.
CMakeLists.txt	Adds TrustZone build flags/sources, STM32H5/L5 origin handling, and separates public vs private compile definitions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.