SCEP: add keep-alive / async SCEP session API

[Frauschi]

Summary

Adds a keep-alive / non-blocking SCEP (RFC 8894) client session, the SCEP counterpart to the existing EST session. This is the last piece needed for feature-equivalence with wolfSCEP: SCEP enrollment can now run several PKIOperation round trips over one connection, and drive them non-blocking through a caller-owned event loop (poll/epoll/kqueue).

No public API is changed or removed; this is purely additive plus an internal refactor shared with the EST path.

What's included

• WolfCertScepSession with blocking and non-blocking opens, plus PKCSReq, RenewalReq and GetCertInitial in _ex (blocking) and _nb (WANT_READ/WANT_WRITE pumped) forms.
• Internal refactor: do_scep_round_trip split into reusable scep_prepare (envelope + sign), scep_build_transport (POST vs base64 GET), and scep_finish (parse + verify + de-envelop). The one-shot and session paths share these; one-shot behavior is unchanged.
• Shared origin builder: the scheme://host[:port] construction duplicated by the EST and SCEP session opens is factored into wolfcert_http_url_origin so the two cannot drift.
• Docs and build wiring: ARCHITECTURE.md, EMBEDDED.md context, CLAUDE.md, plus CMake + autoconf registration of the new test.

New public API (wolfcert/scep.h)

Function	Purpose
wolfcert_scep_session_open / _open_async	Open a blocking / non-blocking session
wolfcert_scep_session_close	Tear down; zeroizes any in-flight private-key copy
wolfcert_scep_session_fd	Backing socket fd for poll/epoll/kqueue
wolfcert_scep_session_pkcs_req_ex / _nb	Enroll (PKCSReq)
wolfcert_scep_session_renewal_req_ex / _nb	Renew (RenewalReq)
wolfcert_scep_session_get_cert_initial_ex / _nb	Poll a PENDING enrollment (GetCertInitial)

Design notes

• Mirrors the EST session in structure (one round trip in flight at a time, _ex/_nb split, same non-blocking HTTP session layer). The crypto stays synchronous; only the HTTP POST/GET is pumped through the state machine. The transactionID, senderNonce, and finish-phase inputs (CA bundle, signer cert/key) are captured in the session so they survive across pumps.
• No TLS requirement, unlike EST. SCEP authenticates at the pkiMessage layer (the CMS signature is bound to the CA/RA bundle and the recipientNonce echo is enforced), so a plaintext http:// endpoint is accepted. An https:// endpoint, however, now requires verify_server rather than silently running an unauthenticated handshake.

Hardening and correctness

• RNG return codes checked in scep_prepare: a wc_InitRng_ex / wc_RNG_GenerateBlock failure now fails the round trip instead of building a pkiMessage over an uninitialized transactionID and anti-replay senderNonce. (Pre-existing behavior in the one-shot path; fixed for both, now that the code is shared.)
• Session misuse guards, all returning WOLFCERT_ERR_BAD_ARG:
  • a mismatched _ex/_nb pairing against the session's open mode (this also makes an in-flight-buffer / private-key-copy leak unreachable),
  • starting a different operation while one is in flight,
  • resuming a poll with a different WolfCertScepResult* than the one captured at begin (guards against a silently-empty result or a dangling-pointer write).

Testing

tests/integration/test_scep_async_roundtrip.c drives the in-tree test server end to end:

Scenario	Covers
A	Async enrollment; blocking-session enrollment + blocking RenewalReq
B	Async PENDING -> GetCertInitial poll (keep-alive)
C	Async enrollment -> async RenewalReq (keep-alive)
D	Misuse guards: _ex-on-async, _nb-on-blocking, in-flight op-type mismatch
E	Blocking PENDING -> GetCertInitial poll (get_cert_initial_ex)
F	Session forced onto the base64 GET transport

The async scenarios are pumped through a real poll(2) loop. All 25 project tests pass (including the 12 EST tests, which exercise the shared origin-builder refactor); build is warning-clean.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12

Scan targets checked: wolfcert-bugs, wolfcert-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12

Scan targets checked: wolfcert-bugs
Failed targets: wolfcert-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12

Scan targets checked: wolfcert-bugs, wolfcert-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12

Scan targets checked: wolfcert-bugs, wolfcert-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.