Zephyr: wolfSSL module support for the wolfPSA provider and native RTOS use

Extend the wolfSSL Zephyr module for the wolfPSA-provider and secure-sockets
efforts:

  - Native RTOS threading: wolfCrypt's Zephyr port uses k_mutex/k_thread/
    k_condvar directly (no CONFIG_POSIX_THREADS), with k_condvar gated on the
    kernel version, covered by a native-threading ztest wired into CI.
  - Config interface: a user-supplied CONFIG_WOLFSSL_SETTINGS_FILE is
    authoritative and the module never layers Kconfig #defines over it. The
    module-default block is shaped by build-profile knobs (WOLFSSL_CRYPTO_ONLY,
    WOLFSSL_SINGLE_THREADED, which now defaults from !MULTITHREADING) plus new
    classic-crypto/TLS/PQC feature knobs (RSA/ECC/ChaCha-Poly/Curve25519/SNI/
    session-cache/session-ticket and ML-KEM/ML-DSA/LMS/XMSS/Falcon, each with
    its memory-reduction "small" options). A consumer such as wolfPSA validates
    its own requirements rather than the module injecting them.
  - DRBG seeding: wc_GenerateSeed() on Zephyr draws seed material from the
    hardware entropy driver when present (chunked to the entropy API's uint16_t
    length, DT_HAS_CHOSEN-guarded) and falls back to sys_rand_get() otherwise;
    HAVE_HASHDRBG stays guarded by WC_NO_HASHDRBG.
  - z_time(): read the native_sim simulator RTC for a real wall clock on the
    native targets regardless of libc.

Verified on native_sim/native/64 and nucleo_h743zi.

.github/scripts/zephyr-4.x/zephyr-test.sh

@@ -10,7 +10,8 @@
 #   -b, --branch <branch>  wolfSSL branch/revision
 #   -z, --zephyr <version> Zephyr version tag
 #   -t, --target <board>   Board target
-#   -s, --sample <name>    Sample to build
+#   -s, --sample <name>    Sample/test app to build
+#   -d, --subdir <dir>     App subdir under zephyr/ (samples or tests; default samples)
 #   -v, --verbose          Verbose compile output (show full compiler commands)
 #   -W, --werror           Build with -Werror (treat warnings as errors)
 #   --commit <sha>         Checkout specific commit after fetching branch
@@ -49,6 +50,7 @@ WOLFSSL_BRANCH="master"
 ZEPHYR_VERSION="v4.1.0"
 BOARD_TARGET="native_sim"
 SAMPLE_NAME="wolfssl_tls_sock"
+SUBDIR="samples"
 INTERACTIVE=0
 VERBOSE=0
 WERROR=0
@@ -92,6 +94,7 @@ while [[ $# -gt 0 ]]; do
         -z|--zephyr)  ZEPHYR_VERSION="$2"; shift 2 ;;
         -t|--target)  BOARD_TARGET="$2"; shift 2 ;;
         -s|--sample)  SAMPLE_NAME="$2"; shift 2 ;;
+        -d|--subdir)  SUBDIR="$2"; shift 2 ;;
         -v|--verbose) VERBOSE=1; shift ;;
         -W|--werror) WERROR=1; shift ;;
         --commit) WOLFSSL_COMMIT="$2"; shift 2 ;;
@@ -123,7 +126,7 @@ echo "==> wolfSSL repo:   ${WOLFSSL_REPO}"
 echo "==> wolfSSL branch: ${WOLFSSL_BRANCH}"
 echo "==> Zephyr version: ${ZEPHYR_VERSION}"
 echo "==> Board target:   ${BOARD_TARGET}"
-echo "==> Sample:         ${SAMPLE_NAME}"
+echo "==> Sample:         ${SUBDIR}/${SAMPLE_NAME}"
 echo "==> Docker image:   ${DOCKER_IMAGE}"
 [[ -n "$WOLFSSL_COMMIT" ]] && echo "==> Commit:         ${WOLFSSL_COMMIT}"
 [[ "$WERROR" == "1" ]] && echo "==> Werror:         enabled"
@@ -144,6 +147,7 @@ set -euo pipefail
 ZEPHYR_VERSION="__ZEPHYR_VERSION__"
 BOARD_TARGET="__BOARD_TARGET__"
 SAMPLE_NAME="__SAMPLE_NAME__"
+SUBDIR="__SUBDIR__"
 WOLFSSL_REPO="__WOLFSSL_REPO__"
 WOLFSSL_BRANCH="__WOLFSSL_BRANCH__"
 WOLFSSL_COMMIT="__WOLFSSL_COMMIT__"
@@ -224,11 +228,11 @@ if [[ "$INTERACTIVE" == "1" ]]; then
     echo " wolfSSL:   modules/crypto/wolfssl"
     echo ""
     echo " Example build commands:"
-    echo "   west build -p always -b ${BOARD_TARGET} modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME}"
+    echo "   west build -p always -b ${BOARD_TARGET} modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME}"
     echo "   west build -t run"
     echo ""
     echo " To run twister tests:"
-    echo "   ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME} -vvv"
+    echo "   ./zephyr/scripts/twister -T modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME} -vvv"
     echo "=========================================="
     echo ""
     exec /bin/bash
@@ -256,7 +260,7 @@ else
     fi
 
     west build -p always -b "${BOARD_TARGET}" \
-        "modules/crypto/wolfssl/zephyr/samples/${SAMPLE_NAME}" \
+        "modules/crypto/wolfssl/zephyr/${SUBDIR}/${SAMPLE_NAME}" \
         ${CMAKE_ARGS:+-- $CMAKE_ARGS}
 
     echo ""
@@ -300,7 +304,7 @@ else
                     exit 1
                 fi
                 # Check for success strings
-                if grep -q "Benchmark complete\|Test complete\|Client Return: 0" "${RUN_LOG}" 2>/dev/null; then
+                if grep -q "Benchmark complete\|Test complete\|Client Return: 0\|PROJECT EXECUTION SUCCESSFUL" "${RUN_LOG}" 2>/dev/null; then
                     echo "==> [container] App completed successfully!"
                     APP_RC=0
                     kill "${RUN_PID}" 2>/dev/null || true
@@ -315,7 +319,7 @@ else
 
             if [[ $APP_RC -ne 0 ]]; then
                 # Process exited on its own - check if it printed a success string
-                if grep -q "Benchmark complete\|Test complete\|Client Return: 0" "${RUN_LOG}" 2>/dev/null; then
+                if grep -q "Benchmark complete\|Test complete\|Client Return: 0\|PROJECT EXECUTION SUCCESSFUL" "${RUN_LOG}" 2>/dev/null; then
                     APP_RC=0
                 else
                     echo "==> [container] App exited without a success string"
@@ -336,6 +340,7 @@ INNER_SCRIPT
 BUILD_SCRIPT="${BUILD_SCRIPT//__ZEPHYR_VERSION__/$ZEPHYR_VERSION}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__BOARD_TARGET__/$BOARD_TARGET}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__SAMPLE_NAME__/$SAMPLE_NAME}"
+BUILD_SCRIPT="${BUILD_SCRIPT//__SUBDIR__/$SUBDIR}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_REPO__/$WOLFSSL_REPO}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_BRANCH__/$WOLFSSL_BRANCH}"
 BUILD_SCRIPT="${BUILD_SCRIPT//__WOLFSSL_COMMIT__/$WOLFSSL_COMMIT}"