Fix result size estimation.

[werwurm]

The result buffer size of the gnostic node implementation was not
correct for various reasons.

• n20_issue_certificate returned prematurely on the x509 rendering path
  if a NULL buffer was given or a buffer that was too small.
• In addition, the signature encodings for P256/P384 have varying size.
  This means that the correct size cannot be determined without
  performing the signature, which cannot be computed with a buffer to
  render the TBS part of the certificate, and even if that was
  available, with non-deterministic ECDSA, the size estimate is not
  idempotent.

This patch:

• fixes n20_issue_certificate such that it computes the
  worst-case size of the X509 certificate.
• Relaxes the size estimation contract such that it allows for
  overestimates.
• Adds unit tests to check the size estimation contract.

[github-actions]

LCOV of commit 13a4a4c during lcov-test-coverage-report #197

Summary coverage rate:
  lines......: 95.5% (3046 of 3188 lines)
  functions..: 99.1% (232 of 234 functions)
  branches...: 87.0% (1657 of 1904 branches)

Files changed coverage rate: n/a

[Copilot]

Pull request overview

This PR fixes and formalizes buffer size estimation for certificate/signature outputs (especially X.509) by allowing safe overestimation and adding tests to enforce the contract across key types and formats.

Changes:

• Update X.509 issuance to support size-query mode and compute a worst-case required size (accounting for variable ECDSA DER encoding).
• Relax and document the service/dispatcher size-estimation contract to permit small overestimates that are still guaranteed sufficient on retry.
• Add parameterized unit tests covering NULL/insufficient buffer behaviors for X.509 and COSE.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/service/test/gnostic.cpp	Adds gnostic service-level tests validating size estimation for issued certs/signatures.
src/core/test/functionality.cpp	Adds core-level tests for n20_issue_certificate size estimation and adjusts key handle accounting.
src/core/functionality.c	Implements X.509 size-query / worst-case estimation behavior in the core issuance path.
include/nat20/service/service.h	Documents updated size-estimation contract for service operations.
include/nat20/service/service_message_dispatch.h	Documents dispatcher behavior for insufficient-buffer sizing (including overestimates).
include/nat20/functionality.h	Documents n20_issue_certificate size-query semantics and X.509 vs COSE precision guarantees.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.