attestation: redesign V1 as direct CBOR platform/stack schema

[kvinwang]

Summary

• keep VersionedAttestation::V0 as the wire format
• carry report_data_payload inside a new TDX AttestationQuote variant
• update quote helpers/simulators to preserve the payload-aware TDX quote variant

Why

/var/run/dstack.sock in dstack-k8s needs to return a verifier-visible payload preimage for report_data, but this is better modeled as a platform-specific attestation quote variant than as a new top-level versioned envelope.

Validation

• cargo check -p dstack-attest -p ra-tls -p dstack-guest-agent -p dstack-guest-agent-simulator
• cargo clippy -p dstack-attest -p ra-tls -p dstack-guest-agent -p dstack-guest-agent-simulator -- -D warnings