Implement verified TLS 1.2/1.3 client library with adapted backend forks

[JaxCalder]

Implement dmtls as a DMOD library with private Mbed TLS / TF-PSA-Crypto forks adapted to the existing GOT loader. Global callback and coordinate pointers use typed DMOD_GLOBAL_POINTER slots; descriptor text is stored inline. TLS algorithms and ECC precomputation remain upstream implementations. Fork changes are conditional on MBEDTLS_DMOD_C.

The library supplies verified TLS 1.2/1.3 clients with CA/hostname/date checks, SNI, explicit strong entropy, dmutc time, nonblocking borrowed transport, finite deadlines and heap/connection limits. Production module dependencies are unversioned dmosi and dmutc. No driver or port is added.

The SDK and 240-byte DMF format remain unchanged. A module-local, read-only ELF audit rejects absolute pointers outside existing relocation sections; it currently supports ARM ELF32 and x86-64 ELF64. CI uses existing SDK tools. The release workflow builds the three supported profiles.

Backend PRs: choco-technologies/mbedtls#1 and choco-technologies/TF-PSA-Crypto#1. Both archives are pinned by commit and SHA-256; their provenance and licenses are documented.

Validation:

• Actual module lifecycle / CA checks: 3/3 on x86-64 and STM32F746G-DISCO, using the existing loader.
• Independent OpenSSL interoperability and error/ownership cases: 18/18.
• Pointer-audit regression fixtures: 3/3.
• STM32 hardware RNG + UTC + TLS: 7/7, including TLS 1.2/1.3 encrypted echo and close_notify, hostname/CA/date rejection and missing UTC.
• Post-TLS board regressions: UTC 6/6, RTC 12/12, RNG 6/6; time and running UTC service restored.
• Native, Cortex-M4 and Cortex-M7 builds pass; M4 fetched fresh, hash-verified fork archives.
• M7 image: 140388 bytes DMF / 112574 bytes DMFC, plus runtime heap.

Board process exit requires the independent process/FreeRTOS fixes choco-technologies/dmosi-proc#13 and choco-technologies/dmosi-freertos#74, integrated in choco-technologies/dmod-boot#134. The hardware harness uses UART queues against OpenSSL; network transport/HTTPS is outside this test. Renode was omitted as requested. Raw board logs and fixture private keys remain local.