[build] Remove long-obsolete mechanism for wrapping embedded images

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[build] Disable ccache for all relevant build targets

The build process currently attempts to disable ccache for files using
the .incbin directive, but the rule fails to apply to anything beyond
the simple object target.  Fix by applying to all relevant build
targets (including debug objects, assembly listings, and so on).

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[build] Add dependency of generated files upon Makefile

Ensure that any generated files (such as DER forms of X.509
certificates) are rebuilt if the Makefile changes.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add pubkey_match() to check for matching public/private key pairs

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Generalise X.509 cache to a full certificate store

Expand the concept of the X.509 cache to provide the functionality of
a certificate store.  Certificates in the store will be automatically
used to complete certificate chains where applicable.

The certificate store may be prepopulated at build time using the
CERT=... build command line option.  For example:

  make bin/ipxe.usb CERT=mycert1.crt,mycert2.crt

Certificates within the certificate store are not implicitly trusted;
the trust list is specified using TRUST=... as before.  For example:

  make bin/ipxe.usb CERT=root.crt TRUST=root.crt

This can be used to embed the full trusted root certificate within the
iPXE binary, which is potentially useful in an HTTPS-only environment
in which there is no HTTP server from which to automatically download
cross-signed certificates or other certificate chain fragments.

This usage of CERT= extends the existing use of CERT= to specify the
client certificate.  The client certificate is now identified
automatically by checking for a match against the private key.  For
example:

  make bin/ipxe.usb CERT=root.crt,client.crt TRUST=root.crt KEY=client.key

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Use fingerprint when no common name is available for debug messages

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Allow signed timestamp error margin to be configured at build time

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Rewrite X.509 tests using okx()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Rewrite CMS tests using okx()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add tests for x509_check_name()

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[test] Add subject alternative names to X.509 server test certificate

Signed-off-by: Michael Brown <mcb30@ipxe.org>
[crypto] Add support for subjectAltName and wildcard certificates

Originally-implemented-by: Alex Chernyakhovsky <achernya@google.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>