BitBox02 firmware

rust/keystore: wrap lock() in bitbox02-rust

Original is renamed so the compiler can error if we missed one.

By moving all keystore calls to bitbox02_rust::keystore, we can more
easily replace the function bodies with native Rust
implementations (without wrapping C).

releases: Use firmware/vX for all firmwares

Previously `firmware-btc-only` was used as prefix for btconly firmwares.
Going forward `firmware` will be used as prefix for all firmwares.

factorysetup: Let BLE chip store bond db

Let the BLE chip store the bond db during execution of the factory setup
firmware.

factorysetup: update comment about auto_enter/upside_down

The old comment was from a time where jlink was already locked when we
flashed this image, so it was required to be able to get into the
bootloader again. Now this is not the case anymore, but we still need
these two flags to be set properly like this regardless.

keystore: port stretch_retained_seed_encryption_key to Rust

- Replace function body by Rust impl, removing the original C function
and Rust wrapper
- Expose to C using extern "C" and use that in keystore.c

The function now returns bool instead of keystore_error_t for simpler
code. Among all the callsites, only one propagates keystore_error_t
instead of bool, and there we simply return a new error. We don't lose
much info, if it fails in the wild it is surely because of the
securechip and not the hashing.

keystore: wrap and unit test _stretch_retained_seed_encryption_key in Rust

Afterwards we can easily replace the body with a Rust implementation
and know it's correct based on the tests.

securechip: add safe wrapper of securechip_kdf in Rust

test: remove unused mock_memory.c

Remove C salt unit test now covered by Rust

port salt.c to Rust

test_salt.c unit tests is replicated in Rust. The C function body
calls the Rust function so we can also verify the C unit tests still
pass (to be removed in the next commit).

rust: expose memory_get_salt_root to Rust

test: remove unused fake_memory_set_salt_root

fixup! u2f: Do not turn off BLE when U2F is used over USB

U2F: remove option to cancel u2f flows

In the U2F architecture it isn't possible for the device to "cancel" a
user presence check because the browser can always just ask again. The
only way to cancel it is from the OS/browser.

u2f: Do not turn off BLE when U2F is used over USB

iOS devices support u2f over USB, so no need to disable BLE when only
u2f is used.

iOS devices also send one packet of garbage when waking up, 64 null
bytes, which also is ignored, so that the bitbox still can connect to
the iOS device when it is awakened.

releases: add v9.24.0

gestures: Simplify some repetitive code

releases: add v9.23.3

ui/waiting: start with logo, not lockscreen

40d150132797a2c5185fbbb9bf1926b24571780d refactored and introduced a
bug:

old behavior (before above commit)

logo -> lockscreen -> host connects -> logo

above commit changed to this by accident, skipping the logo at the start:

lockscreen -> host connects -> logo

This commit restores the original behavior.

CHANGELOG: mark v9.24.0

bump version vo v9.23.3 and add CHANGELOG entry

make unlock-animation slower again like it used to be

When we switched from libwally to rust-bip39, bip39 unlock became
twice as fast. It feels too fast now.

The animation speed is based on the frame render rate, which is
not fixed. If the animation goes longer than the actual bip39 unlock
computation, the animation afterwards is significantly faster as there
is less work performed per mainloop iteration. In absence of fixed
render frame rates, we just perform the bip39 unlock twice to maintain
the same frame rate. Conincidentally, this results in an unlock speed
which is basically the same as before with libwally, and we get a
security check for free (repeat and double check the bip39 seed).

confirm-gesture: extend active duration

Extend the duration for when the confirm gesture is active so that
involuntary bottom taps are not triggered and so that the confirm
gesture triangle isn't rendered blended into the keyboard.

avoid flicker when changing from lockscreen to waiting screen

The BitBox shows the lockscreen ("See the BitBoxApp") first, and when
the noise connection is initiazed, switches to the BitBox logo, which
stays there as the waiting/default screen until reconnected.

The noise connection is initiated by the host after unlock finishes,
so in between, "See the BitBoxApp" flashes for a split second.

This commit solves this by

1) not pushing the lockscreen as an extra component to be popped, but
folding it into the top/default component

2) updating that screen when the app initiates the connection if the
device is not initialized

3) if initialized, updating the screen on OP_UNLOCK (see comment in code)

This prevents flashing/flickering if the device is initialized. There
is still a small flicker when the device is uninitialized, as the
screen is updated before the pairing confirmation appears. This was
the case before this commit too.

keystore: reduce secure chip operations when unlocking

Every call to `keystore::unlock` is followed by `copy_seed()`. The latter
uses a secure chip operation. We can remove that by returning the seed
from unlock and re-using it.

This reduces the number of securechip operations by 1 when:

- when unlocking the device
- showing mnemonic on initialized device
- creating backu on initialized device

This is to reduce the risk of running into Optiga's throttling
security mechanism.