feat(libsrtp): bump submodule for mbedTLS 4 support; allow IDF v6.0

[vikramdattu]

Summary

• Bump libsrtp submodule from the v2.8.0 release tag (24b3bf8) to 2_x_dev HEAD d33b8ff — the merge of mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813, which adds mbedTLS 4 / PSA Crypto support to the 2.x mbedTLS adapters. The adapters self-select on MBEDTLS_VERSION_MAJOR, so mbedTLS 3 (IDF v5.x) code paths are untouched.
• Drop the idf <6 cap from idf_component.yml — this was gated on exactly this upstream work (the manifest comment referenced mbedTLS 4 support on 2_x_dev — plans? cisco/libsrtp#812). Component version 2.8.0 → 2.8.0~1.
• CI: build get_started + test_apps on release-v6.0 in addition to v5.4/v5.5.

Verification

• test_apps builds clean on IDF v6.0.2 (target esp32, mbedTLS 4.1.0) — full link, exit 0.
• mbedTLS 4 runtime behaviour is covered upstream by mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813's CI (srtp_driver roundtrips against mbedTLS 4.1.0); the mbedTLS 3 path continues to be exercised by this repo's host_test on v5.4/v5.5.

Notes

• host_test stays on IDF v5.x: the IDF v6 linux target currently fails to link any PSA-using app — libtfpsacrypto.a references mbedtls_ms_time / esp_mbedtls_mem_* that live in archives earlier on the link line (static archive ordering, IDF-side; reproduced with IDF's own libs, independent of libsrtp). .build-test-rules.yml documents this next to the disable rule.
• No upstream 2.x release tag carries mbedTLS 4 / PSA Crypto support on 2_x_dev cisco/libsrtp#813 yet (latest is v2.8.0), so this pins the merge commit by SHA; switch to the tag when upstream cuts v2.8.1 / v2.9.
• Sequenced after feat(libsrtp): add component (libsrtp v2.8.0 + ESP-IDF mbedTLS port) #1060 (component introduction, merged).

---

Note

Medium Risk
Touches crypto/SRTP integration and moves off a release tag to a dev-branch commit, though scope is mostly dependency pins, CI matrix, and manifest comments rather than new port logic.

Overview
Enables ESP-IDF v6 for the libsrtp component by advancing the upstream submodule from the v2.8.0 tag to 2_x_dev commit d33b8ff, which includes mbedTLS 4 / PSA Crypto adapters (cisco/libsrtp#813) that pick mbedTLS 3 vs 4 at compile time.

Dependency and packaging: idf_component.yml changes from idf: ">=5.4,<6" to >=5.4, with component version 2.8.0~1 and SBOM metadata updated to the new pin.

CI / build rules: The libsrtp workflow matrix adds release-v6.0 for get_started and test_apps. .build-test-rules.yml removes the blanket “disable IDF v6” rules for those apps and documents v6 as supported; host_test remains disabled on v6 with a clearer reason (Linux PSA link ordering in IDF, not libsrtp).

^{Reviewed by Cursor Bugbot for commit 232c60d. Bugbot is set up for automated code reviews on this repo. Configure here.}

[vikramdattu]

@david-cermak PTAL