Harden wolfSSL and wolfSSH validation

Enable validated ECC imports and X25519 all-zero rejection through
PUBLIC build policy. Tighten wolfSSH parser bounds, overflow handling,
and signature framing with guard-page and crypto vector contracts.

cmake/wolf_crypto_policy.cmake

@@ -5,5 +5,10 @@ idf_component_get_property(_sak_wolf_target wolfssl__wolfssl COMPONENT_LIB)
 if(NOT TARGET "${_sak_wolf_target}")
     message(FATAL_ERROR "wolf crypto policy: missing wolfSSL component target")
 endif()
+# Existing upstream checks, not a vendor-source backport. PUBLIC keeps library
+# and consumer settings consistent without changing the root build file.
+target_compile_definitions("${_sak_wolf_target}" PUBLIC
+    WOLFSSL_VALIDATE_ECC_IMPORT
+    WOLFSSL_ECDHX_SHARED_NOT_ZERO)
 target_compile_options("${_sak_wolf_target}" PUBLIC
     "-include${CMAKE_CURRENT_LIST_DIR}/wolf_crypto_policy.h")