Define the driver interface for interruptible operations properly

[gilles-peskine-arm]

We've implemented interruptible signature (3.x), key agreement (#9490), key generation (#9643) and export-public (#9648) for ECC. We've done a partial job of implementing a driver interface, but it isn't functional yet, and the design of the interface needs some polishing.

This is a design task. The goal is to go over the current ad hoc design, find out what's good and what isn't, and update the specification with a good interface. Then file issues to implement this interface (with corresponding tests).

Known issues:

• How do we convey the presence of accelerator drivers (MBEDTLS_PSA_ACCEL_xxx)? Presumably mimics the interface-level macro(s) (PSA_WANT_xxx).
• For sign/verify and key agreement, we end up with a num_ops field in both the generic operation structure and the driver operation structure. Given that this feature is intended for highly constrained devices, we shouldn't have this kind of duplication.