Add mbedTLS 4.x CI coverage

[Ewerton Scaboro da Silva (ewertons)]

Adds mbedTLS 4.x support.

mbedTLS 3.6 LTS reaches end of life in March 2027. mbedTLS 4.0 moved cryptography into TF-PSA-Crypto and removed the public entropy/CTR_DRBG modules, mbedtls_ssl_conf_rng() and mbedtls_ssl_conf_min_version(), dropped the f_rng/p_rng parameters of mbedtls_pk_parse_key(), made mbedtls_pk_get_type() private, and requires psa_crypto_init() before any cryptographic operation.

Changes

• Submodules: rolls all five azure-c-shared-utility references forward to the commit with mbedTLS 4.x adapter support. The consistency check requires them to agree, so uamqp, umqtt, deps/uhttp and provisioning_client/deps/utpm move with the direct c-utility reference — same shape as Update submodules (add support for mbedTLS 3.x) #2662, which added mbedTLS 3.x.
• build/.vsts-ci.yml: new mbedtls_4x job (build + e2e) alongside 2.16, 2.28 and 3.x.
• doc/configure_tls_protocol_version_and_ciphers.md: notes the mbedtls_ssl_conf_min_version -> mbedtls_ssl_conf_min_tls_version rename.

All five pointers are on master.

Validation

Submodule consistency and "not ahead of master" were checked locally for all five references before pushing. A previous run of this branch had Tests mbedTLS 4.x passing along with 2.16, 2.28 and 3.x (29 jobs succeeded, none failed).

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

Pull request overview

This PR adds CI validation coverage for mbedTLS 4.x and updates documentation to reflect API renames introduced in mbedTLS 4.x, helping ensure the SDK continues to build and run tests as mbedTLS 3.6 approaches EOL.

Changes:

• Add a new Azure Pipelines job (mbedtls_4x) that builds the SDK and runs E2E tests against mbedTLS 4.2.0 on Ubuntu 24.04.
• Update TLS configuration documentation to note the mbedtls_ssl_conf_min_version → mbedtls_ssl_conf_min_tls_version rename/removal in mbedTLS 4.x.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

File	Description
build/.vsts-ci.yml	Adds an mbedtls_4x CI job that installs mbedTLS 4.2.0, builds, and runs E2E tests.
doc/configure_tls_protocol_version_and_ciphers.md	Documents the mbedTLS 4.x API rename/removal for minimum TLS version configuration.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Ewerton Scaboro da Silva (ewertons)]

Tests Ubuntu 24.04 ARM64 (Cross-compile only) failed here for an unrelated reason: apt could not install the arm64 dev libs due to a Multi-Arch: same version skew (libssl3t64:arm64 ... not going to be installed). It fails before any compilation, the same job passed on another PR 12 minutes earlier, and it passes on main.

Fix: #2748. Everything else here is green, including Tests mbedTLS 4.x and 2.16/2.28/3.x (31 jobs succeeded).