Home Key provisioning in Go

Home Key provisioning structures and operations are adapted from:
  kormax/apple-home-key-reader
  https://github.com/kormax/apple-home-key-reader
  Commit 96754078121cfe1792a1e2c402873d105c8016e3
  Apache License 2.0

Upstream credits include kormax (ECP/NFC protocol research), kupa22
(HAP and NFC protocol analysis), and the project's contributors.
Additional protocol documentation: https://github.com/kupa22/apple-homekey

NFC STANDARD authentication and Digital Key secure-response framing adapted from
  kormax/apple-home-key-reader homekey.py, entity.py, util/digital_key.py
  Commit 42454594069529d9d945581afc1cdac59fc187c8
  Apache License 2.0

Changes: Go implementation of provisioning and NFC STANDARD authentication; bounded TLV8 parsing;
validated keys; atomic combined HAP/credential persistence; lifecycle cleanup;
standalone virtual lock; Go tests and Makefile. NFC transport is a bounded BLE APDU mailbox; response MAC and signature
verification, active endpoint authorization and revocation checks are included.
FAST authentication, ECP and NFC attestation exchange are omitted.

The bundled third_party/hap code is from github.com/brutella/hap v0.0.35,
commit bc03ca629d44dd58570c2979843f9f677818e31c. Original license and source
notices are retained. Locally modified files carry notices; the changes are
recorded in patches/hap.patch. Local regression tests are in
third_party/hap/homekey_patch_test.go. Generator, example and image assets
not needed for building the library were omitted.

Sesame OS3 BLE protocol and registration/calibration behavior adapted from:
  CANDY HOUSE SesameSDK_Android_with_DemoApp
  Commit d12f23c (upstream 022289e5b1d082bd3f5ff685c2cf197444847a56)
  Copyright (c) 2014-2026 CANDY HOUSE
  MIT License; full notice retained in drivers/sesame/LICENSE.
Changes: standalone Go implementation with BlueZ transport, bounded framing,
strict session validation, private credential storage and web setup controls.

Sesame BLE transport lifecycle additionally compared with CANDY HOUSE Android SDK
mirror commit 61e2a6a (upstream 8887141f1b5482451442647ff455313b755a8655):
LE advertisement-driven connection, GATT notification setup and teardown.
