BitBox02 firmware

rust/bitbox02/keystore: remove Bip39Wordlist

After the previous refactor, this became a thin wrapper, and is not
even wrapping any C function anymore.

ui/trinary_input_string: merge autocomplete to optimize speed

_maybe_autocomplete is folded into _set_alphabet, so we avoid looping
over all bip39 words yet another time, making the keyboard more speedy.

ui/trinary_input_string: merge two funcs to optimize speed

_set_can_confirm can be folded into _set_alphabet, so we avoid looping
over all bip39 words a second time, making the keyboard more speedy.

ui/trinary_input_string: directly fetch bip39 words

Previously the component was passed an array of string pointers, which
worked well with libwally's static BIP39 word list.

When we want to move to a Rust bip39 wordlist, we can't directly pass
Rust word string pointers (not null terminated).

This commit adapts the component to call a function to get a BIP39
word by index, which can be replaced with a Rust implementation later.

xpubcache: allow choosing if xpub computation should be repeated

End-goal: reduce the number of secure chip ops when signing a BTC
transaction, to reduce the chance of going over the Optiga chip's
"rate limit", which induces throttling.

By default keystore::get_xpub computed the xpub twice, to mitigate
potential bitflips, which could be bad when delivering the wrong
xpub (or derivatives) to the host.

When signing a transaction however, one does not need the extra
protection - if there is a bit flip, the resulting signature will be
invalid.

This commit reduces the number of secure chip ops needed when the
bitflip mitigation is not required.

The existing method `get_xpub` was renamed so the compiler can tell us
all the instances where we need to decide between one or the other.

keystore: pass private key to nonce_commit() and sign()

End-goal: reduce the number of secure chip ops when signing a BTC
transaction, to reduce the chance of going over the Optiga chip's
"rate limit", which induces throttling.

With antiklepto, we derived the private key twice for each input that
is signed: once to commit to the nonce, and after that to sign.

This commit decouples the nonce commit and sign functions from the
underlying keystore, and allows reusing a private key instead of
re-deriving it, which requires secure chip operations.

This halves the number of secure chip ops needed per input when
signing a BTC transaction.

We do not reuse the privkey for the other instances of
antiklepto (signing a msg, signing an ETH tx), as there it's one
commit/sign pair only and unlikely to cause secure chip throttling.