pex-pqc: add sntrup761-based post-quantum WireGuard PSK exchange

pex-pqc: add sntrup761-based post-quantum WireGuard PSK exchange

Implement periodic WireGuard preshared key renewal using a hybrid
pqKK handshake (PQNoise framework [1]) with sntrup761 as KEM and an
additional Curve25519 DH encryption layer on the first ciphertext.

Both peers' static sntrup761 public keys are pre-distributed via the
host config (pqc-key). The initiator role is determined by public key
comparison. The three KEM shared secrets (k1, k2, k3) are combined
via SHA-512 to derive the WireGuard PSK.

Handshakes are driven by the connect timer with bounded retransmission,
sending to all known peer endpoints with deduplication.

[1] Y. Angel, B. Dowling, A. Hulsing, P. Schwabe, F. Weber,
    "Post Quantum Noise", ACM CCS 2022. https://eprint.iacr.org/2022/539

Co-developed-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>