Attestation Proxy Client

Create attestation proxy client for copilot.

The attestation proxy will be an optional copilot integration, and likely a completely separate application. Copilot will leverage a REST client in order to query an attestation proxy based on a predefined behavior. Copilot will not need to know how each attestation service works, which will simplify the integration.

Some pilot agents will be deployed in environments where users wish to leverage local platform attestation services such as [KeyLime](https://keylime.dev/). Copilot will query the attestation proxy to ask simply if a given `pilot_agent_id` has been attested before issuing a requested KEK. This will be an AND decision combined with the standard authorization procedure.

Failure to attest will result in a 403 forbidden response, just like a `kek_authorized: false` decision from the database.

Start by locating Copilot’s KEK authorization procedure and the REST client entry point; the issue names no files or tests. Clarify the proxy contract and integration boundary, then verify that an unattested pilot_agent_id produces the described 403 decision alongside the existing authorization result.

Scritto dal modello di indicizzazione a partire dal testo della issue.