Add Phase 9C security hardening

Generate exact-hash SDK source overrides without modifying dependencies.
Harden
SSH allocation and algorithm policy, tighten web authentication cleanup,
and add
focused host contract tests and documentation.

tests/web_cookie_auth/run.py

@@ -253,7 +253,9 @@ with tempfile.TemporaryDirectory(prefix="web-cookie-auth-") as directory:
                     *(["-DHOST_BROKER"] if broker else []),
                     *(["-DHOST_SSH_SETTINGS"] if ssh_settings else []),
                     *(["-DHOST_LIFECYCLE"] if lifecycle else []),
-                    "-I" + str(tmp), "-I" + str(ROOT / "src"), *map(str, sources), "-lcrypto", *(["-lmbedcrypto"] if ssh_settings else []),
+                    "-I" + str(tmp), "-I" + str(ROOT / "src"), *map(str, sources),
+                    "-Wl,--wrap=web_auth_parse_login,--wrap=secure_wipe,--wrap=httpd_resp_set_hdr",
+                    "-lcrypto", *(["-lmbedcrypto"] if ssh_settings else []),
                     "-o", str(tmp / "test")], check=True, timeout=30)
     subprocess.run([str(tmp / "test")], check=True, timeout=20)
     if lifecycle: