RSA-PSS sign 1: PK

[mpg]

Opaque RSA keys introduced in #5625 can only do PKCS#1v1.5 signatures, with mbedtls_pk_sign(). This task is to extend them to also support PSS signatures, with mbedtls_pk_sign_ext() (introduced in #5559).

• Change mbedtls_wrap_as_opaque() so that it allow both algorithms.
• Extend mbedtls_pk_sign_ext() to work with an opaque key.
• Make sure it's tested, either by extending the existing ,pk_psa_sign_ext() or writing a new one, as is more convenient.

Depends on: #5625
Follow-up: #5712

[superna9999]

@mpg is it required to also implement/test verify_ext with an Opaque key?

[mpg]

Nope, currently we only aim to support private-key operations with opaque keys. (Doing public-key operations with Opaque key pairs, or implementing Opaque public keys, may be useful at some point, but that's much less of a priority.)