[wireguard] Keep allowed IPs in a shared flash table (#20087)

Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>

tests/component_tests/wireguard/config/allowed_ips.yaml

@@ -0,0 +1,26 @@
+esphome:
+  name: test
+
+esp32:
+  board: esp32dev
+  framework:
+    type: esp-idf
+
+wifi:
+  ssid: test
+  password: password1
+
+time:
+  - platform: sntp
+    id: sntp_time
+
+wireguard:
+  time_id: sntp_time
+  address: 172.16.34.100
+  netmask: 255.255.255.0
+  private_key: wPBMxtNYH3mChicrbpsRpZIasIdPq3yZuthn23FbGG8=
+  peer_public_key: Hs2JfikvYU03/Kv3YoAs1hrUIPPTEkpsZKSPUljE9yc=
+  peer_endpoint: wg.server.example
+  peer_allowed_ips:
+    - 172.16.34.0/24
+    - 192.168.0.0/16

tests/component_tests/wireguard/test_allowed_ips.py

@@ -0,0 +1,21 @@
+"""Tests for the wireguard allowed IPs codegen."""
+
+from collections.abc import Callable
+from pathlib import Path
+
+
+def test_allowed_ips_are_a_progmem_table(
+    generate_main: Callable[[str | Path], str],
+    component_config_path: Callable[[str], Path],
+) -> None:
+    """Allowed IPs live in a flash table ended by an empty entry instead of a heap vector."""
+    main_cpp = generate_main(component_config_path("allowed_ips.yaml"))
+
+    table = main_cpp.split(
+        "wireguard::AllowedIP wireguard_allowed_ips[] PROGMEM = ", 1
+    )[1]
+    table = table.split(";", 1)[0]
+    assert '.ip = "172.16.34.0"' in table
+    assert '.netmask = "255.255.0.0"' in table
+    assert ".ip = nullptr" in table
+    assert "->set_allowed_ips(wireguard_allowed_ips);" in main_cpp