Add WOLFCOSE_LEAN config layer with WOLFCOSE_HAVE_* feature gates

[aidangarske]

• Default unchanged: all wolfSSL-provided algorithms enabled, no breaking change
• New WOLFCOSE_LEAN: core-only build (Sign1/Encrypt0/Mac0 + ES256/AES-GCM/HMAC-256)
• Extensions opt-in with WOLFCOSE_ENABLE_<X>; WOLFCOSE_ENABLE_ALL enables all
• New include/wolfcose/settings.h resolves config into WOLFCOSE_HAVE_* flags
• Default adapts to wolfSSL; explicit enable of a missing capability is a #error
• Sources/tests/examples gate on WOLFCOSE_HAVE_*, so lean make test runs only enabled algos
• Key-setter prototypes aligned with impls; CBOR / AES-wrap / ECDH-ES #error guards added
• Enabled scenario examples that were silently disabled on main; fixed flaky group-broadcast tamper check
• No Makefile change; only MISRA workflow stale-macro fix
• Update docs
• addresses WOLFCOSE_LEAN Minimal Build Profile #21
• addresses user_settings update to cohesively enable/disable features #11

[mattia-moffa]

There still seem to be references to raw HAVE_ECC which should probably be WOLFCOSE_HAVE_ECDSA: src/wolfcose.c at lines 4072, 4241, 4669 (the latter two also call wolfCose_EccSignRaw / wolfCose_EccVerifyRaw which are only defined with WOLFCOSE_HAVE_ECDSA).

Also WOLFCOSE_HAVE_CHACHA20/AESCCM/HMAC384/HMAC512/AESMAC seem to only be used in the tests and examples, not in the source.