Fix legacy WSS certificate support and receive retries

Share the APP/kernel TLS profile, enable ECDSA and AES-GCM, and use RTC time for certificate validation. Fix WANT_READ/WANT_WRITE handling during WebSocket upgrade and add ABI, certificate, and receive regression checks.

tools/test_mbedtls_cert.py

@@ -0,0 +1,27 @@
+"""Build the SDK's real crypto/X.509 sources with MSVC and test the server chain.
+Run from a Visual Studio developer shell. Chain PEMs come from the WSS probe.
+"""
+from pathlib import Path
+import subprocess
+import sys
+
+root = Path(__file__).resolve().parents[1]
+output = root / 'artifacts/wss/ecc-fix/host-cert'
+output.mkdir(parents=True, exist_ok=True)
+chain = Path(sys.argv[1]).resolve() if len(sys.argv) > 1 else root / 'artifacts/wss/retest-443'
+sources = '''asn1parse asn1write bignum base64 pem oid pk pkparse pk_wrap rsa rsa_internal
+ecp ecp_curves ecdsa md md5 sha1 sha256 sha512 aes des gcm cipher cipher_wrap
+chacha20 chachapoly poly1305 constant_time ctr_drbg x509 x509_crt platform_util
+ecdh ssl_ciphersuites'''.split()
+command = ['cl', '/nologo', '/O2', '/Gy', '/TC', '/D_CRT_SECURE_NO_WARNINGS',
+           '/DMBEDTLS_CONFIG_FILE="wss_tls_host_config.h"',
+           '/I' + str(root / 'tools'), '/I' + str(root / 'tools/wss_host_stubs'),
+           '/I' + str(root / 'ql-kernel/threadx/common/include'),
+           '/I' + str(root / 'ql-application/threadx/interface/custom_app/inc'),
+           str(root / 'tools/test_mbedtls_cert.c'),
+           str(root / 'ql-application/threadx/interface/custom_app/talkingq_root_ca.c')]
+command += [str(root / ('ql-kernel/threadx/quec_mbedtls/' + name + '.c')) for name in sources]
+exe = output / 'test_mbedtls_cert.exe'
+command += ['/Fe' + str(exe), '/link', '/OPT:REF']
+subprocess.run(command, cwd=output, check=True)
+subprocess.run([str(exe), str(chain)], check=True)