Description

• Replace the hand-written DICE CBOR and COSE_Sign1 encoder with wolfCOSE.
• Use wc_CBOR_Encode* for the EAT payload and wc_CoseSign1_Sign_ex with WOLFCOSE_SIGN1_UNTAGGED for each DICE token.
• Add wolfCOSE as lib/wolfCOSE and wire it into Makefile and CMake WOLFCRYPT_TZ_PSA builds.
• Keep token sizing free of signing operations so sizing does not advance the CDI.
• Fix the STM32H5 UDS fallback to read the device UID from 0x08FFF800.
• Support software DICE with local ES256 signing and hardware DICE through the external signer callback.

Dependencies

• Add delegated signing seam wolfCOSE#59 provides delegated signing.
• Add wc_CoseSign1_Sign_ex with an untagged output option wolfCOSE#65 provides the explicit untagged Sign1 API and exact size query.
• Both dependencies are merged; lib/wolfCOSE pins upstream commit 588232e.

Validation

• wolfCOSE normal suite, external signing test, C99 check, and forced external signer failure test pass on the combined dependency.
• The dedicated wolfBoot DICE size test passes all 32-, 48-, and 64-byte challenge cases against upstream 588232e.
• M33MU CI image ghcr.io/wolfssl/wolfboot-ci-m33mu:latest passes with a 340-byte token, untagged 0x84 prefix, and PSA boot attestation: success.
• NUCLEO-H563ZI hardware passes with the same 340-byte untagged token and PSA boot attestation: success.