Moving attestation generation and verification code to `attest` repo.

@alexhulbert has started https://github.com/flashbots/attest which can compute measurements from an OS image together with CVM configuration.

The idea is that CVM configuration data would be sent as part of the attestation evidence payload, and a verifier would use it to compute the expected measurements for that particular instance. Eg: for GCP we would probably include the machine type and region. This would save us needing to have pre-computed measurement values for every combination of accepted OS image version and CVM configuration.

Since this involves both generation and verification, the proposal is to move the contents of the `attestation` crate over to that repo.

If doing that, it would probably also make sense to move the `pccs` crate and not-yet-merged `mock-tdx` crate there as well, as i think they belong together with attestation rather than attested-tls.

The alternative would be to do it the other way around and move everything into this repo.

Tagging @0x416e746f6e as you were not around when we were talking about this last week.