Apply Phase 9D security mitigations

- Add fail-closed wolfSSL small-math policy and vectors
- Backport DHCP, EMS, and X.509 allocation fixes
- Extend source override validation and operational documentation

cmake/wolf_crypto_policy.cmake

@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-3.0-only
+# Apply after project(). PUBLIC propagates the resolved-settings guard to every
+# wolfSSL consumer, including wolfSSH and the application (ABI-sensitive keys).
+idf_component_get_property(_sak_wolf_target wolfssl__wolfssl COMPONENT_LIB)
+if(NOT TARGET "${_sak_wolf_target}")
+    message(FATAL_ERROR "wolf crypto policy: missing wolfSSL component target")
+endif()
+target_compile_options("${_sak_wolf_target}" PUBLIC
+    "-include${CMAKE_CURRENT_LIST_DIR}/wolf_crypto_policy.h")