Blockstream Jade

build: update jade_builder image references

tools: esp32 move OS functions to flash from IRAM when wifi logging on

jadepy: update setup.py install deps

sign_tx: suppress validation/change attribution for green 2of3 outputs

Since the recovery xpub is not currently registered on-device, we should
not trust the caller provided value, and users must validate the address
on-device. A malicious companion app could otherwise swap out the
recovery xpub to grief the user.

This brings sign_tx behaviour in line with sign_psbt for Green 2of3.

A future update will allow user-confirmed registration for Green 2of3
which will allow skipping the confirmation for these outputs.

jadepy: update jadepy release

jade_cli: add required arguments to sign_tx

ui: tidy up message/error activities

Fix spelling of "re-encrypt".

build: move production config directory into the configs directory

ci: add security stage

fonts: speed up/simplify fetching glyph data

Note that glyph looking is still O(N), and thus string length
calculation and display is O(N^2). This commit merely makes the existing
linear lookup faster.

The linear lookup is a consequence of the font structure allowing
characters to be out of order. If we were to force the characters to be
ordered in the font definition we could trivially implement an index
to allow even faster lookups.

tools: remove jade_capture_image_data.py since jade_cli can do this now

fonts: simplify font setting

Note that data such as the maximum character width, computed when each font
is set could be computed at compile time, or cached when first set.

fonts: remove unused inverted fonts

wire: make ble message handling use the same logic as other inputs

The ble logic was the only user of reject_incomplete, which it used to
process existing buffer data inconsistently.

Now that all handlers use the same logic we can investigate strategies
for attempting to re-sync message streams when an error occurs.

tests: re-enable large qr code tests for 1.1 devices

Now that we allow processing of valid data receieved after a timeout, the
occasional write-level split of the input qr data shouldn't cause this
test any issues.

tests: test splitting the write for concatenated messages

wire: refactor handle_message, enable all message tests for libjade

Require any candidate message be a valid map up-front since this is a
prerequisite for the message to be a valid RPC message.

Ignore reject_incomplete which will be removed in an upcoming commit.

Note we continue to attempt to parse including new data that has arrived
after the timeout before discarding stale data.

tests: enable "too much input" test for libjade

wire: merge handle_data()/handle_data_impl()

No functional changes; removes a couple of now-redundant asserts.

wire: reduce stack usage sending replies

This offsets the increased stack usage from the previous commit.

libjade: handle received bytes in the same way as the serial device

Send all bytes through handle_data(), in chunks if required.

This allows testing the real world comms behaviour using libjade,
with the exception that BLE message handling is currently different
to both (and arguably incorrect).

wire: remove transport specific output buffers

These are only ever used to reject messages which can be done with a
temporary ~128 bytes of stack instead of a permanent 3-9kb of RAM.

wire: fix not processing all received data when wire.c timeout hit

Minor code cleanup to make the existing logic clearer.

tests: allow qemu tests to run longer

qemu: fix outdated scripts/documenation