[2.8.0] Add packet authenticity policy settings source

[RCGV1]

Problem

MUI settings source needs the same Packet authenticity policy defined in meshtastic/design#121, so generated assets and the device-ui runtime do not diverge from companion clients.

Requested design-source change

Add the platform-appropriate Security settings control and source assets for:

• Compatible — accept unsigned.
• Balanced — prefer signed (recommended/default).
• Strict — require signed.

Use the existing settings hierarchy and constrained-display conventions. Strict should have a confirmation or warning state if the generator/runtime supports one without introducing a new dialog system.

Acceptance criteria

• Source project/assets contain every state needed by the paired device-ui implementation.
• Labels fit supported 240×320 and 320×240 layouts and remain localizable.
• Generated/runtime boundary is documented in the linked PRs; generated artifacts are intentional and reproducible.
• Visual evidence covers all values, focus/selection, Strict warning, and both target resolutions.
• The PR links design#121 and the paired device-ui issue, and remains draft until device hardware verification.

[RCGV1]

Scope update from design#121: Strict is authenticated-only for every decryptable remote packet, not broadcast-only. New firmware signs signable non-PKI unicast/control packets as well as broadcasts; Strict accepts verified XEdDSA or successfully authenticated PKI and rejects other decrypted traffic regardless of portnum/destination. Use Strict supporting copy such as “Only show and process cryptographically authenticated mesh packets. Older nodes and oversized packets may disappear.”.

[RCGV1]

Implementation is actively in progress by @RCGV1 under meshtastic/design#121, with a draft PR forthcoming. GitHub does not currently allow this account to self-assign in this repository; please coordinate here before starting duplicate work.

[RCGV1]

Scope correction from design#121: this feature does not create a new authentication version and does not broaden normal-mode outbound signing. It only configures firmware receive enforcement using Meshtastic's existing XEdDSA/PKI results. Strict drops every decryptable remote packet that is not authenticated by an existing valid XEdDSA signature or successful existing PKI decryption before local storage/client/module/MQTT processing. Existing normal-mode broadcast signing and PKI direct-message behavior remain unchanged. Authenticated plaintext licensed/ham broadcasts and direct messages are tracked separately in design#122.