Fix certificate cache key malleability

[leanthebean]

Summary

• Key non-root certificate cache entries by keccak256(tbsCertificate) instead of full DER bytes.
• Keep the AWS Nitro root pinned to ROOT_CA_CERT_HASH and reject malleable root aliases.
• Update docs, demo script output, and regression tests for the new cache key semantics.

Security issue

CertManager.verifyCACertWithHints previously used keccak256(raw cert bytes) as the verification cache key. The outer X.509 certificate signature is ECDSA P-384, and low-S is intentionally not enforced because AWS Nitro signatures may not be low-S. That means a valid certificate can have a byte-distinct (r, n-s) signature twin with the same signed TBS, subject, and public key.

Because verifiedParent is write-once, a caller could cache a shadow parent under the malleated full-DER hash, then pin a genuine child certificate to that alternate parent. Honest warm validation using the canonical certificate chain would later hit parent cert mismatch, producing a persistent denial of service for the hinted Nitro attestation path.

Fix

Non-root certificate cache identity now derives from the signed tbsCertificate bytes. ECDSA signature malleability only changes the outer signature bytes, so canonical and malleated encodings of the same certificate resolve to the same cache entry. The pinned root remains keyed by ROOT_CA_CERT_HASH; if a malleated root encoding verifies under the root key, CertManager rejects it as root cert alias so it cannot become a second trusted parent cache key.

This preserves support for AWS Nitro P-384 signatures without adding a low-S requirement, while removing the malleable bytes from the cache identity used by verifiedParent.

Tests

• forge fmt
• forge test

Added regression coverage showing that:

• a malleated non-root certificate and its canonical encoding share the same TBS cache key;
• the canonical certificate warm path succeeds after the malleated encoding has been cached;
• a malleated root alias reverts with root cert alias.

Addresses CAT finding 15bf935b-8ecd-4cd6-aba6-40123684840c.