[aidangarske]

PR to wolfTrust-dev2 aarc64 PR #29

wolfTrust originally had limited PKCS #11 support, but it was removed while the PSA interfaces were being completed because that integration was not ready. Now that the PSA path is stable, this PR brings PKCS #11 back and adds an isolated firmware TPM 2.0 service. Applications can keep using PSA, or use the new paths for PKCS #11 operations backed by the TPM and direct TPM 2.0 command traffic.

• Adds wolfTPM and wolfPKCS11 as pinned submodules.
• Adds direct SPM-mediated interfaces for standard PKCS#11 C_* calls and TPM 2.0 commands without using the PSA Crypto API.
• Adds a role-checked SERVICE_PKCS11 relay between applications and an isolated wolfPKCS11 provider backed by wolfHSM.
• Adds a bounded SERVICE_TPM mailbox between applications and an isolated volatile firmware TPM provider.
• Enforces caller roles, frame bounds, handle ownership, connection recovery, locality initialization, and partition-memory scrubbing.
• Adds isolation-level-3 TPM and PKCS#11 partition layouts for STM32H563 and MIMXRT700.
• Keeps both interfaces macro-gated and disabled by default, with checks for unsupported targets and conflicting configurations.
• Adds Zephyr and FreeRTOS M33MU matrix rows for PSA, PKCS#11, and TPM, including full PKCS#11 API coverage and real TPM key, signing, random, and PCR operations.
• Adds TPM and PKCS#11 negative scenarios that verify partition isolation, fault containment, restart, and successful service recovery.
• Adds cross-build and absolute-layout gates for both interfaces on STM32H563 and MIMXRT700.

[dgarske]

This is a big PR. Any way to trim/reduce?

[dgarske]

Missing our standard license header. Other .c's too.