[rom, rom_ext] Run known-answer tests for used cryptographic algorithms before signature verification

@cfrantz is already working on this.

Since Apr 24, 2026.

### Description

To make it easier include ROM, ROM_EXT into certification scope if would be required, it is useful to run known-answer tests for cryptographic algorithms used for signature verification (including those used for cached result). While running something like sha256(const) and checking that result is expected is pretty fast and have minimal impact on code size, tests for signature verification itself can be lengthy and data for known-answer tests will require plenty of room (especially SPHINCS+). But at least for P256/P384 it is feasible as extra code size is a signature size + few extra calls.

To reduce latency known-answer test checking that valid signature validates, and invalid (e.g. bit flipped) is not can run on OTBN in parallel with computing image hashes using SHA256/KMAC/etc.

@moidx , @timothytrippel