Refactor attestation for multi-provider support

[kvinwang]

Why

Previously we only exposed raw TDX quotes, which effectively limited deployments to TDX bare metal. We need a multi-provider compatible attestation format and API so the stack can run on other platforms (GCP/Nitro) while keeping verification consistent and forward‑compatible.

Attestation Structure

• Introduces versioned attestation envelopes via dstack-attest, with explicit version and mode (dstack/GCP/Nitro).
• Attestation payload includes runtime events and platform‑specific evidence, enabling richer verification paths.
• Supports legacy fallback to keep older clients/verifiers working.

RA‑TLS OID Changes

• RA‑TLS certificates now embed the new attestation format under updated OIDs (instead of the prior quote-only payload).
• This aligns cert‑based verification with the same attestation/eventlog pipeline used by RPC/SDK, and enables mode‑aware verification logic.

New Attest API

• Adds an Attest RPC and SDK bindings so clients can request attestations directly, not only via TLS.
• Gateway ACME/cert quoting updated to emit attestations through the new flow.

Summary of Changes

• Added dstack-attest crate (versioned attestations, runtime events, platform-aware modes).
• Migrated RA‑TLS, guest-agent, KMS, verifier, tdx‑attest to the new attestation/eventlog flow with compatibility fallback.
• Added Attest RPC + SDK support; updated gateway cert/ACME quoting.
• Extended types/configs for TPM key provider + host-share disk label; updated system setup and docker compose orphan cleanup.