Trusted cert cache and verify callbacks

[bigbrett]

Introduces two new features and a few cleanups

1. Adds a "Trusted cert cache" maintained by the server for each client that "remembers" certificates (intermediate and leaf) after they are verified as trusted in a cert chain verification operation (based on the SHA256 over the cert). Any time the cert is subsequently encountered in a chain verification operation, the public key verification is short-circuited, and the cert is automatically registered as trusted. Notably, the cert "memory" is bound to the list of roots it was initially verified against. This feature exists to enhance performance in scenarios where the same cert chain is expected to be encountered multiple times (think wolfBoot cert chain auth for a time-critical boot). The cache can be per-client or global. There are definitely some security consequences to this feature but this is noted clearly in the docs. More details in the docs.
2. Adds the ability for the user to inject a verify callback into the certificate manager for cert chain verification. This allows the chain verification to be further exteneded or overriden by the user (domain name/SAN validation, etc.). Note that callbacks will NOT be invoked on cached/trusted certs, as this short circuits the entire verification process for that cert.
3. Completely unrelated fix for uninitialized variable warning in SHE layer
4. Unrelated fix adding padding check macro to prevent transitive includes from blowing up padding check

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #353

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #353

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #353

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅

[AlexLanzano]

Approved. One thing we should look into is if there are use cases where that user-defined callback should be run even on a cache hit.