Harden wolfSSL and wolfSSH validation

Enable validated ECC imports and X25519 all-zero rejection through
PUBLIC build policy. Tighten wolfSSH parser bounds, overflow handling,
and signature framing with guard-page and crypto vector contracts.

cmake/wolf_crypto_policy.h

@@ -4,6 +4,22 @@
 
 #include <wolfssl/wolfcrypt/settings.h>
 
+/* PR10133 recommends this existing check for older releases. In 5.8.2 the
+ * software validator must not be replaced with a successful hardware stub. */
+#if !defined(HAVE_ECC) || !defined(WOLFSSL_VALIDATE_ECC_IMPORT) || \
+    !defined(HAVE_ECC_CHECK_KEY)
+#error "wolf crypto policy: ECC requires validated imports"
+#endif
+#if defined(NO_ECC_CHECK_PUBKEY_ORDER) || defined(WOLF_CRYPTO_CB_ONLY_ECC) || \
+    defined(WOLFSSL_ATECC508A) || defined(WOLFSSL_ATECC608A) || \
+    defined(WOLFSSL_CRYPTOCELL) || defined(WOLFSSL_SILABS_SE_ACCEL) || \
+    defined(WOLFSSL_SE050) || defined(WOLFSSL_STM32_PKA)
+#error "wolf crypto policy: review ECC validation backend before changing it"
+#endif
+#ifndef WOLFSSL_ECDHX_SHARED_NOT_ZERO
+#error "wolf crypto policy: X25519 requires all-zero shared-secret rejection"
+#endif
+
 /* PR9275 selects small math on Xtensa to avoid compiler-introduced timing
  * differences. Check resolved settings, not just command-line intentions.
  * https://github.com/wolfSSL/wolfssl/pull/9275