Add supports for generating identity signing key (IDK_S)

[sangho2]

This PR adds supports for generating identity signing key (IDK_S) to the OP-TEE shim. A new function, generate_identity_signing_key generates an IDK_S key pair based on the platform root key and writes the public portion of it to the VTL0-side buffer. Currently, it returns an uncompressed SEC1 P-384 public key (97 bytes).

[Copilot]

Pull request overview

This PR adds a new LVBS VSM call for deriving an identity signing key pair (IDK_S) from the platform root key and returning the public key to VTL0. It extends the LVBS VSM surface, adds supporting error/host plumbing, and brings in the crypto dependencies needed for P-384 key derivation.

Changes:

• Add GenerateIdentitySigningKey VSM function ID and dispatcher support.
• Implement IDK_S derivation/export logic in mshv::vsm, plus a unit test for the derivation helper.
• Expose PRK retrieval, add new VSM errors, and update dependency/ratchet metadata.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
litebox_platform_lvbs/src/mshv/vsm.rs	Adds IDK_S derivation, public-key export, dispatcher wiring, and a unit test.
litebox_platform_lvbs/src/mshv/mod.rs	Defines the new VSM function ID and enum entry.
litebox_platform_lvbs/src/mshv/error.rs	Adds PRK/IDK_S error variants and errno mappings.
litebox_platform_lvbs/src/host/mod.rs	Re-exports PRK getter for internal use.
litebox_platform_lvbs/src/host/lvbs_impl.rs	Adds PRK getter implementation.
litebox_platform_lvbs/Cargo.toml	Adds hkdf and p384 dependencies.
dev_tests/src/ratchet.rs	Updates the static-count ratchet for LVBS.
Cargo.lock	Locks the newly added crypto dependency graph.

[sangho2]

VTL Call ABI for generating or getting IDK_S is straightforward. The main question is which layer should own IDK_S (LVBS platform/runner vs OP-TEE shim). If IDK_S is used only for OP-TEE scenarios, better to manage it in the OP-TEE Shim/PTA. Otherwise, if IDK_S is for a more general attestation service, better to maintain it in the platform/runner. This PR currently maintains IDK_S stuffs in the platform for simplicity (no cross-layer call is needed).

[github-actions]

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure enum_variant_added: enum variant added on exhaustive enum ---

Description:
A publicly-visible enum without #[non_exhaustive] has a new variant.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#enum-variant-new
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.47.0/src/lints/enum_variant_added.ron

Failed in:
  variant VsmFunction:GenerateIdentitySigningKey in /home/runner/work/litebox/litebox/litebox_platform_lvbs/src/mshv/mod.rs:160