fix: bound attestation CBOR container counts

[leanthebean]

Summary

• Fix CAT finding 58c1f4c1-1da4-4fd1-94c6-6c021b57e0a3.
• Add parser-time caps for attestation pcrs and cabundle counts before allocating CborElement[].
• Reuse MAX_PCRS = 32 for the existing PCR validation limit and add MAX_CABUNDLE_CERTS = 32, which is well above the current AWS Nitro 4-cert bundle.
• Add regression tests for the minimal large-count cabundle payload and the sibling large-count pcrs payload.

Security

validateAttestationWithHints parses attestationTbs before certificate and signature verification. Before this change, a caller could set a huge definite CBOR count for cabundle or pcrs, forcing new CborElement[](count) to trigger quadratic memory expansion and OOG before authentication.

This change rejects excessive counts before allocation, so hostile pre-auth payloads fail with explicit bounded reverts instead of consuming the call gas limit.

Tests

• forge test --match-test 'test_neg_large.*Count_revertsBeforeAllocation' -vvv
• forge test