fix(ota): Add legacy option for devices using MD5 authentication

[lucasssvaz]

Description of Change

This pull request updates the espota.py tool to add support for authenticating with devices that use an older, insecure MD5-based challenge/response protocol, improving compatibility with legacy firmware. The main changes include introducing a new --md5-target option, updating the authentication flow to handle both MD5 and SHA256 mechanisms, and adjusting the argument parsing and function signatures accordingly.

It will first try with SHA authentication and if it fails it will try again with MD5 for backwards compatibility.

Authentication protocol updates:

• Added a new --md5-target (-m) command-line flag to indicate that the target device uses MD5-based authentication, for compatibility with old firmware.
• Modified the serve function and its call sites to accept an additional md5_target argument, controlling which authentication protocol is used. [1] [2]
• Updated the authentication logic in serve to:
  • Receive the correct nonce length depending on protocol (37 bytes for MD5, 69 for SHA256).
  • Generate the client nonce and challenge/response using MD5 or SHA256 as appropriate.
  • Expect the correct response length from the device (32 bytes for MD5, 64 for SHA256).

Test Scenarios

Tested with ESP32-C6

Related links

Closes #11855

[github-actions]

	Messages
📖	🎉 Good Job! All checks are passing!

👋 Hello lucasssvaz, we appreciate your contribution to this project!

---

📘 Please review the project's Contributions Guide for key guidelines on code, documentation, testing, and more.

---

🖊️ Please also make sure you have read and signed the Contributor License Agreement for this project.

---

Click to see more instructions ...

This automated output is generated by the PR linter DangerJS, which checks if your Pull Request meets the project's requirements and helps you fix potential issues.

DangerJS is triggered with each push event to a Pull Request and modify the contents of this comment.

Please consider the following:
- Danger mainly focuses on the PR structure and formatting and can't understand the meaning behind your code or changes.
- Danger is not a substitute for human code reviews; it's still important to request a code review from your colleagues.
- To manually retry these Danger checks, please navigate to the Actions tab and re-run last Danger workflow.

Review and merge process you can expect ...

We do welcome contributions in the form of bug reports, feature requests and pull requests.

1. An internal issue has been created for the PR, we assign it to the relevant engineer.
2. They review the PR and either approve it or ask you for changes or clarifications.
3. Once the GitHub PR is approved we do the final review, collect approvals from core owners and make sure all the automated tests are passing.
- At this point we may do some adjustments to the proposed change, or extend it by adding tests or documentation.
4. If the change is approved and passes the tests it is merged into the default branch.

Generated by 🚫 dangerJS against 70c2825

[me-no-dev]

Did you test this with ArduinoOTA example? Given that there are no changes to platform.txt and that you have changed the argument name, it will not work.

[lucasssvaz]

Did you test this with ArduinoOTA example? Given that there are no changes to platform.txt and that you have changed the argument name, it will not work.

Yeah, it works fine. As described in the PR it will first try to use the new authentication and if it fails fallback to the old one.