[2.8.0] Configure packet authenticity policy

[RCGV1]

Problem

The MUI runtime needs to read and write the configurable XEdDSA broadcast policy specified in meshtastic/design#121, using source assets from the paired standalone-ui issue.

Solution

Add a native Security settings selector bound to Config.SecurityConfig.packet_signature_policy:

• Compatible — accept unsigned.
• Balanced — prefer signed (recommended/default).
• Strict — require signed.

Strict must communicate that older/ham/no-key nodes and oversized unsigned broadcasts may disappear. PKI-encrypted direct messages remain unaffected.

Acceptance criteria

• Read/write the firmware enum without a second runtime-local policy.
• Default/zero renders as Balanced and unsupported firmware degrades safely.
• Keep the existing shield=authentic and lock=private semantics from design#113.
• Add focused tests for enum mapping, selection/save, and Strict confirmation where practical.
• Validate focus/navigation, truncation, localization, and selected/unselected states at 240×320 and 320×240.
• Link the standalone-ui source issue and keep the PR draft until tested on target MUI hardware.

[RCGV1]

Scope update from design#121: Strict is authenticated-only for every decryptable remote packet, not broadcast-only. New firmware signs signable non-PKI unicast/control packets as well as broadcasts; Strict accepts verified XEdDSA or successfully authenticated PKI and rejects other decrypted traffic regardless of portnum/destination. Use Strict supporting copy such as “Only show and process cryptographically authenticated mesh packets. Older nodes and oversized packets may disappear.”.

[RCGV1]

Implementation is actively in progress by @RCGV1 under meshtastic/design#121, with a draft PR forthcoming. GitHub does not currently allow this account to self-assign in this repository; please coordinate here before starting duplicate work.

[RCGV1]

Scope correction from design#121: this feature does not create a new authentication version and does not broaden normal-mode outbound signing. It only configures firmware receive enforcement using Meshtastic's existing XEdDSA/PKI results. Strict drops every decryptable remote packet that is not authenticated by an existing valid XEdDSA signature or successful existing PKI decryption before local storage/client/module/MQTT processing. Existing normal-mode broadcast signing and PKI direct-message behavior remain unchanged. Authenticated plaintext licensed/ham broadcasts and direct messages are tracked separately in design#122.