Expose active key SPIs/fingerprints from TcSecurityDeframer

[nateinaction]

Summary

Add a way to query which SPIs are currently active in a TcSecurityDeframer instance's on-flash key store, along with a fingerprint of each key, so an operator who has lost track of what was provisioned can identify the slots without knowing the key material.

Rationale

TcSecurityDeframer already tracks up to two active slots (m_keyStore / activeKeyCount() / activeSpiSlots() in TcSecurityDeframer.hpp), but none of that is exposed to ground. If an operator forgets which SPI(s) and keys are provisioned on a given link (UART/LoRa/S-band), there's currently no way to find out short of trial and error with PROVISION_KEY/ADD_KEY/REMOVE_KEY.

Required changes

1. Add a command and/or telemetry channel that reports the active SPI(s) for a TcSecurityDeframer instance.
2. Alongside each SPI, report a fingerprint of the associated key (e.g. a truncated hash) rather than the key itself, so the response never leaks key material.
3. Cover the new command/telemetry with unit and/or integration tests.

Acceptance criteria

• Ground can query a TcSecurityDeframer instance and get back its active SPI(s) plus a non-reversible fingerprint per key.
• No raw key bytes are ever included in the response.
• Relevant tests pass.

Backlinks

• PR: Move HMAC auth key off firmware image onto internal-flash key store #472
• Review comment: Move HMAC auth key off firmware image onto internal-flash key store #472 (comment)

Requested by: @ineskhou, agreed by @nateinaction