testing: add boringtun throughput benchmark and iperf ref-compare harness

New testing/boringtun/ harness runs two Cloudflare BoringTun userspace
WireGuard containers with iperf3 between them, giving a single-hop
userspace tunnel baseline for comparison against FIPS throughput
numbers. Local WG key generation runs through the harness image so the
host needs no wireguard-tools.

New testing/static/scripts/iperf-compare-refs.sh builds two git refs
into separate fips-test:* images via git worktree and runs the same
static iperf topology against both, with RUNS-based repetition and
aggregate avg/min/max reporting.

testing/static/scripts/iperf-test.sh gains DURATION, PARALLEL,
SETTLE_SECONDS, IPERF_TIMEOUT env knobs and a per-path iperf timeout.
testing/static/docker-compose.yml selects the image under test via
FIPS_TEST_IMAGE; testing/scripts/build.sh respects CARGO_TARGET_DIR.

Author benchmark on aarch64 Docker Desktop:
  boringtun bob -> alice : 1000.13 Mbits/sec

testing/boringtun/scripts/bench.sh

@@ -0,0 +1,25 @@
+#!/bin/bash
+# End-to-end iperf3 bandwidth test between two boringtun containers.
+# Output mirrors testing/static/scripts/iperf-test.sh so the FIPS
+# numbers are directly comparable.
+set -euo pipefail
+
+DURATION="${DURATION:-10}"
+PARALLEL="${PARALLEL:-1}"
+
+echo "=== boringtun iperf3 throughput (single TCP stream, ${DURATION}s) ==="
+
+# Run iperf3 server on alice (background), client on bob.
+docker exec -d bt-alice iperf3 -s -1 -B 10.99.0.1 -p 5201
+sleep 1
+
+# wait for tun handshake to settle (boringtun + WG keepalive)
+sleep 2
+
+# Client: bob → alice over WG (10.99.0.1)
+OUT=$(docker exec bt-bob iperf3 -c 10.99.0.1 -p 5201 -t "$DURATION" -P "$PARALLEL" -J)
+
+# Pull SUM bps.
+MBPS=$(echo "$OUT" | python3 -c "import json,sys; d=json.load(sys.stdin); print(f\"{d['end']['sum_received']['bits_per_second'] / 1_000_000:.2f}\")")
+
+echo "boringtun bob -> alice : ${MBPS} Mbits/sec"

testing/boringtun/scripts/generate-keys.sh

@@ -0,0 +1,40 @@
+#!/bin/bash
+# Generate WG keypairs for alice and bob and write the
+# generated/peers.env file the docker-compose.yml reads.
+# Idempotent: skips if file already exists.
+set -e
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+OUT_DIR="$SCRIPT_DIR/../generated"
+ENV_FILE="$OUT_DIR/peers.env"
+
+if [ -f "$ENV_FILE" ]; then
+    echo "$ENV_FILE already exists; reusing keys"
+    exit 0
+fi
+
+mkdir -p "$OUT_DIR"
+
+# Use the built boringtun-test image to generate keys — host may
+# not have wireguard-tools installed. The `pubkey` step needs `-i`
+# so stdin is piped through; `genkey` doesn't need it but matching
+# flags keeps the two calls symmetric.
+GEN_CMD="docker run --rm --entrypoint wg boringtun-test:latest"
+PUB_CMD="docker run --rm -i --entrypoint wg boringtun-test:latest"
+
+ALICE_PRIV=$($GEN_CMD genkey)
+ALICE_PUB=$(printf '%s' "$ALICE_PRIV" | $PUB_CMD pubkey)
+BOB_PRIV=$($GEN_CMD genkey)
+BOB_PUB=$(printf '%s' "$BOB_PRIV" | $PUB_CMD pubkey)
+
+cat >"$ENV_FILE" <<EOF
+ALICE_PRIV=$ALICE_PRIV
+ALICE_PUB=$ALICE_PUB
+BOB_PRIV=$BOB_PRIV
+BOB_PUB=$BOB_PUB
+ALICE_WG_IP=10.99.0.1/24
+BOB_WG_IP=10.99.0.2/24
+PEER_PORT=51820
+EOF
+chmod 600 "$ENV_FILE"
+echo "wrote $ENV_FILE"