refactor(ra-tls): separate attestation from issuer claims - #967

Problem

VerifiedRaTlsCert mixed two different trust domains in one result type:

• attestation evidence verified against a TEE trust root and bound to the certificate public key
• app-id, app-info, and usage extensions whose authenticity comes from normal certificate-chain validation and the KMS issuer

Putting both in a type named VerifiedRaTlsCert made issuer claims look attestation-verified. It also encouraged comparing them to embedded attestation even though KMS-issued certificates may intentionally omit attestation.

Change

• rename the result to VerifiedRaTlsAttestation
• return only the certificate public key and verified attestation evidence
• provide decode_app_info() to derive application identity from verified evidence when attestation is present
• stop returning issuer-backed certificate extensions from the attestation verification API
• make verifier certificate output report application identity only from verified attestation
• document that KMS certificate claims must be consumed after normal certificate-chain verification

This preserves the intended trust model: KMS signs and backs certificate identity extensions, while RA-TLS attestation verification is a separate optional proof bound to the leaf key.

Verification

• cargo fmt --manifest-path dstack/Cargo.toml --all
• cargo test --manifest-path dstack/Cargo.toml -p ra-tls
• cargo check --manifest-path dstack/Cargo.toml -p dstack-verifier
• cargo clippy --manifest-path dstack/Cargo.toml -p ra-tls -p dstack-verifier --all-targets -- -D warnings
• git diff --check