New sdk-fuzz target `fuzz_nbgl_page` exercising the NBGL page/layout
construction layer (lib_nbgl/src/nbgl_page.c + nbgl_layout.c). That layer is
compiled from source and instrumented, while the display/HAL layer stays
mocked (fuzzing/mock/nbgl).

The harness builds a fuzzed nbgl_pageContent_t from the input tail and drives
three entry points:
  - nbgl_pageDrawGenericContent with 6 content types (TAG_VALUE_LIST,
    SWITCHES_LIST, INFOS_LIST, CHOICES_LIST, BARS_LIST, CENTERED_INFO)
  - nbgl_pageDrawInfo
  - nbgl_pageDrawConfirmation
Strings are carved from the tail into a bounded pool and item arrays are
clamped. No new link deps: secure_sdk already pulls in nbgl + the HAL mock.

(cherry picked from commit 8f94db5)

Found by SDK fuzzing (UBSan implicit-signed-integer-truncation):
availableHeight is a uint16_t decremented by the height each list item consumes.
When content is taller than the screen it underflows to a large value,
defeating the `availableHeight > 10` guard meant
to stop drawing separation lines near the bottom of the container.

Make availableHeight signed (int) in addContent() and
nbgl_pageDrawGenericContentExt(); the > 10 comparisons stay correct.

(cherry picked from commit 6690175)