[codex] Add AWS NitroTPM attestation platform support

[h4x3rotab]

Summary

Adds the AWS EC2 NitroTPM platform path for dstack under the account-admin-untrusted threat model.

This includes:

• AWS NitroTPM attestation parsing, verification, PCR replay, and platform-specific API output.
• AWS-aware KMS/key-release checks, including measured config/app binding and attested recipient-key handling without relying on AWS KMS.
• PCR14 launch measurement design and PCR23 runtime/app measurement support.
• freshness/replay policy checks and endpoint identity verification support.
• auth-simple and auth-eth policy handling for AWS attestation modes.
• production verifier docs, reproducibility manifests, AMI promotion helpers, EC2 live-smoke helpers, and committed AWS evidence.

Final live evidence records an Attestable AMI smoke test:

• AMI: ami-015b720d2e3e9dd9c
• root snapshot: snap-022c271b9790aebf3
• shared snapshot: snap-0efa19b7528e14142
• live smoke instance: i-00ad5b777c394914d
• result: passed

Validation

• cargo test -p dstack-attest aws_nitro_tpm
• cargo test -p dstack-kms aws_nitro_tpm
• cargo test -p dstack-verifier aws
• RA-TLS endpoint identity tests
• npm run test:run and npm run lint in kms/auth-simple
• forge test --ffi and Jest tests for kms/auth-eth
• bash -n and shellcheck for AWS helper scripts
• JSON manifest validation with jq
• committed console SHA256 check
• live EC2 smoke test against the promoted Attestable AMI

Notes

The AWS live-smoke path uses NitroTPM as the measurement/attestation provider and local key provider. It does not use AWS KMS.