Bluetooth: Add BT_SMP_ENFORCE_MITM option

[MariuszSkamra]

Having this option disabled, MITM flag state can be controlled by
bt_conn_security state. This option is enabled by default to not
change the current implementation behavior.
Related to SM/MAS/SCPK/BV-01-C.

Fixes #17463

[zephyrbot]

All checks are passing now.

Review history of this comment for details about previous failed status.
Note that some checks might have not completed yet.

[jhedberg]

Will you also have a patch to update the tester app? If that's needed it might be easier (for the subsequent backport) to include them both in the same PR.

[MariuszSkamra]

Will you also have a patch to update the tester app? If that's needed it might be easier (for the subsequent backport) to include them both in the same PR.

I would wait with tester app PR for now. I think it will be necessary to modify btp documentation as well to add security level parameter to Opcode 0x11 - Pair command/response (or separate command). It's fixed now, set to BT_SECURITY_MEDIUM.

[sjanc]

yeap, this is needed for manual testing only
we can think on how to extend btp when more tests will be added for autopts

[joerchan]

I don't think the addition of the mitm flag is required. When we receive a request we shouldn't let the peer's MITM flag say that we can we want MITM protection unless we can actually acheive it.
And when sending requests, we already check that the required sec_level can be acheived by checking the IO capabilites.
I think the BT_SMP_ENFORCE_MITM option should be the only change.

[backporting]

The backport to v1.14-branch failed:

Commits ["f3cc3b038837207b278ac173efb269bc5f501929"] could not be cherry-picked on top of v1.14-branch

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub.
git fetch
# Create new working tree.
git worktree add .worktrees/backport v1.14-branch
# Navigate to the new directory.
cd .worktrees/backport
# Cherry-pick all the commits of this pull request and resolve the likely conflicts.
git cherry-pick f3cc3b038837207b278ac173efb269bc5f501929
# Create a new branch with these backported commits.
git checkout -b backport-17464-to-v1.14-branch
# Push it to GitHub.
git push --set-upstream origin backport-17464-to-v1.14-branch
# Go back to the original working tree.
cd ../..
# Delete the working tree.
git worktree remove .worktrees/backport

Then, create a pull request where the base branch is v1.14-branch and the compare/head branch is backport-17464-to-v1.14-branch.