Port the bundled mbedTLS to the 4.1 LTS before 3.6 support ends #255

libhxcpp bundles mbedTLS 3.6, whose LTS support ends in March 2027. The next LTS, 4.1 (supported to 2029), is a real port rather than a drop-in:

• crypto moves into TF-PSA-Crypto, so `mbedtls-files.xml` needs rebuilding from the new source layout;
• `mbedtls_ssl_conf_rng`, the ctr_drbg and entropy contexts and `mbedtls_oid_get_attr_short_name` are gone;
• errors become PSA status codes.

Lime builds against the same copy in static builds (#161), so the port has to keep that provider interface working. Split out of #147, where the other upgrades are done.