simu: let the host see what a module transmits

[nikklaswallerstedt]

Fixes #

Summary of changes:

The WASM/SIMU target can be told what a module receives but not what it
sends, so a host has no way to answer the radio's RF module. This adds the
missing direction.

The gap. radio/src/targets/simu/module_drivers.cpp points every module
port at _fakeSerialDriver, whose sendBuffer discards its argument. The
inbound half is already there — simuSendTelemetry() hands bytes to
processCrossfireTelemetryFrame() — so a host can inject telemetry, but
anything the firmware writes to the module is dropped before it leaves the
simulator.

The consequence. Nothing that expects a reply from the module can work.
Concretely: ExpressLRS ships SCRIPTS/TOOLS/elrs.lua, and running it off a
real SD card in a SIMU build gets as far as "Loading..." and stays there
forever. The script's CRSF DEVICE_PING is written to the module port and
discarded, so no host could know a reply was wanted, let alone what to reply.
The script is correct and the radio is correct; there is simply no wire.

The change.

• simulib.h: one new import, simuModuleSendBuffer(uint8_t module, const uint8_t* data, uint32_t len) — module is 0 for internal, 1 for external —
  documented as the reverse of the existing simuSendTelemetry().
• module_drivers.cpp: _intmoduleSerialDriver, identical to the existing
  stub except that sendByte/sendBuffer hand their bytes to the host, and
  the internal module's port entries use it.

Two deliberate choices, both easy to change if you would rather they were
different:

• Internal only. The external port stays on _fakeSerialDriver. Only the
  internal path has been exercised, and a port nobody listens to seemed better
  left obviously silent than half-wired.
• Both internal-port branches. INTMODULE_USART selects which of the two
  ETX_MOD_PORT_* entries is compiled, and picking only one fails silently:
  the driver goes unreferenced, is dead-stripped, the import never appears in
  the .wasm, and the sole symptom is that no frames ever arrive. Routing both
  costs nothing and removes a very confusing failure mode.

Tested on tx12mk2 (PCB=X7), which takes the soft-serial branch. With the
import in place, unmodified elrs.lua off a stock ExpressLRS SD card finds the
internal CRSF module, draws its parameter menu, and writes packet rate and
transmit power back to a host-side module implementation. Nothing else about
the build changes; on targets whose host does not provide the import, the
behaviour is the same as before.