feat: restrict remote LocalStats requests to configured admin keys

[RCGV1]

Problem

Detailed LocalStats includes radio-health data such as noise floor. Device owners need a default shared-channel path plus an option to allow detailed remote diagnostics only to configured remote-admin keys. Requested DeviceMetrics needs an independent lock-down option, but only while its mesh broadcast is disabled.

The wire settings are proposed in meshtastic/protobufs#1023:

• SecurityConfig.local_stats_request_policy
• SecurityConfig.device_telemetry_request_policy

This implementation is blocked on generated firmware bindings from that schema.

Required behavior

LocalStats

• CHANNEL (zero/default): a remote Telemetry.local_stats request and reply use normal channel encryption; do not require PKI.
• ADMIN_PKI: accept a remote LocalStats request only when it is PKI-encrypted and its exact 32-byte sender key matches one of SecurityConfig.admin_key.

Requested DeviceMetrics

• CHANNEL (zero/default): preserve existing DeviceMetrics request behavior.
• ADMIN_PKI is effective only while moduleConfig.telemetry.device_telemetry_enabled is false. When broadcasting is enabled, continue the existing request behavior because the same data is already broadcast.
• When effective, accept a remote DeviceMetrics request only from a PKI-encrypted exact configured admin key.

Denial and reply contract

• A directly connected client request (from == 0 PhoneAPI path) remains available in every policy.
• An authorized admin-only reply is PKI-encrypted; it must not fall back to channel encryption.
• An unauthorized remote request returns the existing Routing_Error.NOT_AUTHORIZED NAK with the original request ID. A channel request receives a channel-encrypted NAK; a PKI request receives a PKI-encrypted NAK. This is an explicit result for a user-initiated request, not a capability advertisement.
• Never emit a new capability broadcast or NodeInfo field for diagnostic policy or admin membership.
• Unknown policy values and excluded-PKI builds deny remote admin-only requests using the same NOT_AUTHORIZED NAK.
• Only Telemetry.local_stats receives the default shared-channel exception; other telemetry variants retain existing behavior.

Validation

Add native wire-level tests for default LocalStats channel behavior, explicit PKI LocalStats, non-LocalStats isolation, authorized PKI admin, non-admin PKI sender with PKI NOT_AUTHORIZED NAK, channel sender while locked with channel NOT_AUTHORIZED NAK, broadcast-enabled DeviceMetrics behavior, broadcast-disabled locked DeviceMetrics, excluded-PKI denial, request ID preservation, and direct attached-client behavior.