Migrate attestation_service proto codegen to buf so we can use protovalidate UUID constraints in shared types

## Background

In PR #8 ([comment thread](https://github.com/GoogleCloudPlatform/key-protection-module/pull/8#discussion_r3216914647)) we wanted to add `(buf.validate.field).string.uuid = true` to `KeyHandle.handle` so the gRPC layer would reject malformed UUIDs declaratively, instead of duplicating `uuid.Parse(...)` checks in every handler.

This had to be reverted because `km_common/proto/crypto_types.proto` (which defines `KeyHandle`) is imported by `keymanager/attestation_service/proto/api.proto`, and attestation's codegen uses `protoc` (because it depends on `attestation.proto` from confidential-space which is not a buf module). `buf.validate` annotations require `buf` codegen.

## Possible solution

Migrate attestation_service's codegen to `buf`, then re-add the UUID constraint to `KeyHandle.handle` and remove the manual `uuid.Parse` calls from:

- `key_protection_service/grpc_server.go` (DecapAndSeal, DestroyKEMKey, GetKEMKey)

Start with keymanager/attestation_service/proto/api.proto and km_common/proto/crypto_types.proto, then inspect the current attestation_service code-generation setup and the UUID checks in key_protection_service/grpc_server.go. Done means attestation codegen uses buf, KeyHandle.handle has the protovalidate UUID constraint, and the listed handlers no longer call uuid.Parse while the project still builds.

Written by the indexing model from the issue text.