Should MBEDTLS_PSA_CRYPTO_CLIENT be a configuration option?

[gilles-peskine-arm]

From Mbed TLS 3.x, we've inherited MBEDTLS_PSA_CRYPTO_CLIENT as an option guarding client-side PSA crypto code, a small subset of MBEDTLS_PSA_CRYPTO_C which covers the generic PSA crypto code (key store functionality, generic dispatch code). Should we keep supporting builds without MBEDTLS_PSA_CRYPTO_CLIENT? On the one hand, you can't have any stable API for cryptography. On the other hand, this could be ok for corner cases, e.g. just for ASN.1.

Tentative definition of done — may be revised based on the architectural decision:

• If we do keep MBEDTLS_PSA_CRYPTO_CLIENT as an option, there should be an all.sh component that builds the library with it disabled.
• If we don't want MBEDTLS_PSA_CRYPTO_CLIENT as an option, it shouldn't be listed in the configuration file, and in fact it probably shouldn't appear in the library source code at all.