Add NXP i.MX RT700 (MIMXRT798S) support

[aidangarske]

• Adds wolfBoot support for the NXP i.MX RT700 (MIMXRT798S), a Cortex-M33 TrustZone-M crossover MCU that boots XIP from external
  octal SPI NOR on XSPI0. Validated on the MIMXRT700-EVK.
• New HAL hal/imx_rt7xx.{c,h,ld}: a debug UART on LPUART0 and an XSPI0 NOR flash driver (program, erase, read-modify-write) on the
  NXP MCUXpresso SDK.
• No ROM flash API on this part, so the flash path runs from RAM through a bounded IP transaction layer with deadline-bounded
  polls plus a queue and SFM reset on timeout.
• Three configs: imx-rt700 (ECC256), imx-rt700-tz (TrustZone secure application handoff via WOLFBOOT_SECURE_APP), imx-rt700-mldsa
  (ML-DSA-44/65/87 for a CNSA 2.0 chain).
• Before handoff, wolfBoot programs and locks the XSPI Secure Flash Protection descriptors (FRAD/MDAD) so the bootloader region is read-only to the application, and refuses to boot if it cannot verify them.
• Adds a test app (test-app/app_imx_rt7xx.c and ARM-imx_rt7xx.ld) with its flash routines placed in RAM like the bootloader; the secure-app config builds wolfboot.bin only, since its payload is a Secure runtime.
• CI: three imx-rt700*.config jobs in test-configs.yml built from the west MCUXpresso SDK (mimxrt700evk board) with the default make, plus a host unit test for the XSPI0 flash address gate.
• docs/Targets.md gains an NXP i.MX RT700 section (build, flash map, TrustZone handoff, EVK flashing).
• Tested: all three configs cross-build on the west SDK and a standalone pack; silicon boot on the EVK for ECC256 and ML-DSA-44/65/87, update swap and rollback, flash and protection self-tests, and the measured TrustZone handoff consumed by the Secure runtime; host unit test passes.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #908

Scan targets checked: wolfboot-src, wolfboot-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

stale/incorrect review

[danielinux]

in the mldsa.config, because of the 12KB header size vs. the 16KB image header size, the rollback is broken (tested). Adjust either block size as suggested by copilot, or extend IMAGE_HEADER_SIZE to align to the block size