Upgrade the nRF51 bootloader and softdevice when flashing

[evoggy]

Release archives carry a combined nRF51 bootloader+softdevice binary
(type: bootloader+softdevice, provides: [sd-s130]), and the nRF51 firmware
declares which softdevice it needs (requires: [sd-s130]). cflib uses this to
move older Crazyflies from S110 to S130 as part of a normal flash. cfcli ignored
the bundle, so it could not bring a Crazyflie that is still on S110 up to date.

bootload flash now flashes the bundle first when it is needed, then the rest
of the archive. A Crazyflie that still needs it usually runs firmware too old
for this cfcli to connect to, so it is flashed cold, as the hint from #21
suggests.

When the bundle is flashed

The softdevice on the device is worked out from where its bootloader says the
firmware starts (page 88 = S110, 108 = S130). The bootloader version comes from
the info packet.

• The firmware needs a softdevice that neither the device nor the archive has:
  error, nothing is flashed.
• The device runs S110 and the archive provides S130: flash.
• The device runs S130 and the archive provides S110: refused. Upgrades only
  go forwards, so cfcli never needs to carry an old softdevice.
• Same softdevice: flash only if the archive's bootloader release is newer than
  the device's. The original bootloader reports no version and counts as older
  than anything.
• A bundle given with --bin nrf51-bootloader+softdevice=<file> has no release
  version and is always flashed, after a confirmation (below).

If the upgrade is refused, the Crazyflie is restarted into its firmware rather
than left in the bootloader.

Flashing it

This follows cflib:

1. Erase the first page of the nRF51 firmware. A bootloader update interrupted
   half-way then stays in bootloader mode instead of jumping into a partly
   overwritten firmware.
2. Write the bundle so that it ends at the last page the bootloader can write.
3. Restart into the bootloader and follow it to its own address.
4. Re-read the bootloader info, since the flash layout moves with the
   softdevice. The nRF51 firmware from the same flash is then written at the new
   start page.

nrf51-bootloader+softdevice is added to the list of flash targets.

Confirming a bootloader from a file

A bundle from a release or zip is a released bootloader, but one given with
--bin can be anything. If it does not start, the Crazyflie can no longer be
flashed over the radio and can only be recovered with an SWD debug probe. So
bootload flash and swarm bootload flash warn and ask before flashing one
(default no; once for the whole swarm). --accept-bootloader-risk flashes it
without asking and is required when running non-interactively (exit code 30
without it). Releases and zips are flashed without asking.

Depends on bitcraze/cfloader-rs#2

This uses the bootloader version, reset_to_bootloader() and refresh_info()
from that PR. Cargo.toml points at its branch for now and should go back to a
crates.io release once one is published.

Testing

• cargo test: unit tests cover the bundle decision for a --bin bundle, a
  current release and a newer release, and when the confirmation is needed.
• The S110 → S130 path was run end to end before rebasing onto current main:
  a Crazyflie 2.1 downgraded to S110 (2023.11) was upgraded to 2026.08 over a
  cold boot (see Report the bootloader version and restart into a new bootloader cfloader-rs#2).
• Before this rebase the --bin bundle path put a development nRF51
  bootloader on eight Crazyflie 2.1 Brushless, with the bootloader's flash CRC
  checked against the file afterwards.
• The non-interactive refusal without --accept-bootloader-risk was run; the
  interactive prompt has not been exercised on hardware.

[evoggy]

This fixes #15