kms: check KMS authorization during bootstrap and onboard

[kvinwang]

Summary

Add KMS authorization checks to bootstrap / onboard / trusted RPC flows:

• check whether the current KMS is allowed before Bootstrap
• check whether the source KMS is allowed before accepting keys during Onboard
• check whether the current KMS is still allowed before trusted runtime operations
• cache the current KMS boot info for the lifetime of the process
• keep compatibility by skipping these new checks when quote_enabled = false

Covered trusted RPCs

• GetAppKey
• GetAppEnvEncryptPubKey
• GetKmsKey
• GetTempCaCert
• SignCert

Details

This change reuses a shared BootInfo builder so bootstrap / onboard / runtime checks use the same attestation-derived fields as the existing KMS authorization path.

The local KMS boot info is stable for the running process, so it is cached and reused across trusted RPCs. The auth decision itself is still checked on each trusted RPC.

Behavior:

• quote_enabled = true
  • Bootstrap verifies local KMS boot info and calls bootAuth/kms
  • Onboard verifies the source KMS attestation and calls bootAuth/kms
  • trusted runtime RPCs verify the local KMS is allowed before proceeding
• quote_enabled = false
  • skip the new bootstrap self-check
  • skip the new onboard receiver-side source-KMS authorization check
  • skip the new trusted-RPC self-check

Validation

Code:

• cargo check -p dstack-kms
• cargo fmt --all
• cargo clippy -p dstack-kms --all-targets -- -D warnings

Manual integration flow:

• added tests/docs/kms-self-authrization.md
• exercised the doc on teepod2 with a prebuilt test image
• validated:
  • bootstrap deny / allow with quote_enabled = true
  • onboard receiver-side deny / allow with quote_enabled = true
  • runtime trusted-RPC self-check allow / deny with quote_enabled = true
  • bootstrap compatibility with quote_enabled = false
  • runtime trusted-RPC compatibility with quote_enabled = false
• clarified in the doc that:
  • noquote receiver onboarding does not fail on the new receiver-side check
  • but it still correctly fails later against a quoted source KMS that requires attested callers (GetKmsKey path)

CC #571 — that PR also has a related guard-rail / defense-in-depth effect.