zephyr-cp: make TLS 1.2 ECDHE and PEM certificates work on the Pico W boards

Two Kconfig gaps kept an HTTPS server (or client) from ever completing a
handshake on these boards:

- Zephyr's mbedTLS 4 default serves secp256r1 through the p256-m PSA driver
  and leaves the builtin ECP module out. mbedTLS then defines the dummy
  MBEDTLS_ECP_MAX_BITS 1, and ssl.h sizes the TLS 1.2 premaster buffer
  (union mbedtls_ssl_premaster_secret._pms_ecdh[MBEDTLS_ECP_MAX_BYTES]) from
  it: sizeof(handshake->premaster) was 1 in the firmware (DWARF). Every ECDHE
  key agreement then failed -- "psa_raw_key_agreement() returned -138
  (-0x008a)", PSA_ERROR_BUFFER_TOO_SMALL for a 32-byte shared secret -- and
  the raw PSA status leaked through mbedtls_ssl_read() as OSError 138 on the
  first read of any TLS connection. Disabling the p256-m driver brings the
  builtin ECP module back and the buffer is 32 bytes again. This is an
  upstream sizing bug (ssl.h should size that buffer from PSA when the ECP
  module is absent); the Kconfig is the workaround until it is fixed.

- PEM parsing was not compiled in, so load_cert_chain() with the usual
  fullchain.pem / key.pem could only fail; the collector's certstore is PEM.

Verified on a Pico 2 W: an RSA-2048 PEM certificate served from CIRCUITPY
over the softAP; an ESP32-C6 client completed the handshake and received
"HTTP/1.0 200 OK" in 2.0 s. Flash +1,868 B (PEM) and +4,716 B (builtin ECP
instead of p256-m) on the Pico 2 W; no static RAM change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: tyeth

ports/zephyr-cp/boards/raspberrypi/rpi_pico2_w_zephyr/board.conf

@@ -25,6 +25,21 @@ CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
 CONFIG_MBEDTLS_ENTROPY_C=y
 CONFIG_MBEDTLS_CTR_DRBG_C=y
 
+# The collector's captive portal serves HTTPS from a PEM certificate chain
+# (fullchain.pem / key.pem via ssl.SSLContext.load_cert_chain); mbedTLS only
+# parses DER unless PEM decoding is compiled in.
+CONFIG_MBEDTLS_PEM_PARSE_C=y
+
+# TLS 1.2 ECDHE. Zephyr's mbedTLS 4 default serves secp256r1 through the p256-m
+# PSA driver and leaves the builtin ECP module out. mbedTLS then defines a dummy
+# MBEDTLS_ECP_MAX_BITS of 1, and ssl.h sizes the TLS 1.2 premaster buffer
+# (union mbedtls_ssl_premaster_secret._pms_ecdh[MBEDTLS_ECP_MAX_BYTES]) from
+# it, so every ECDHE key agreement fails with PSA_ERROR_BUFFER_TOO_SMALL -- a
+# 1-byte buffer for a 32-byte shared secret -- and surfaces as OSError 138 on
+# the first read of any TLS connection, client or server. Keep the builtin
+# ECP module (p256-m off) until the header sizes that buffer from PSA.
+CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=n
+
 # Bluetooth over the shared gSPI bus (CONFIG_BT itself comes from the
 # zephyr,bt-hci chosen node in the overlay).
 #

ports/zephyr-cp/boards/raspberrypi/rpi_pico_w_zephyr/board.conf

@@ -25,6 +25,21 @@ CONFIG_MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256=y
 CONFIG_MBEDTLS_ENTROPY_C=y
 CONFIG_MBEDTLS_CTR_DRBG_C=y
 
+# The collector's captive portal serves HTTPS from a PEM certificate chain
+# (fullchain.pem / key.pem via ssl.SSLContext.load_cert_chain); mbedTLS only
+# parses DER unless PEM decoding is compiled in.
+CONFIG_MBEDTLS_PEM_PARSE_C=y
+
+# TLS 1.2 ECDHE. Zephyr's mbedTLS 4 default serves secp256r1 through the p256-m
+# PSA driver and leaves the builtin ECP module out. mbedTLS then defines a dummy
+# MBEDTLS_ECP_MAX_BITS of 1, and ssl.h sizes the TLS 1.2 premaster buffer
+# (union mbedtls_ssl_premaster_secret._pms_ecdh[MBEDTLS_ECP_MAX_BYTES]) from
+# it, so every ECDHE key agreement fails with PSA_ERROR_BUFFER_TOO_SMALL -- a
+# 1-byte buffer for a 32-byte shared secret -- and surfaces as OSError 138 on
+# the first read of any TLS connection, client or server. Keep the builtin
+# ECP module (p256-m off) until the header sizes that buffer from PSA.
+CONFIG_MBEDTLS_PSA_P256M_DRIVER_ENABLED=n
+
 # File descriptors. Zephyr sizes the fd table from the subsystems' declared
 # needs (ZVFS_OPEN_ADD_SIZE_*), which came to 4 here; the DHCPv4 server takes
 # one socket plus the socket-service eventfd, leaving a program two, and