Align policy hash verification between SNP and TDX

[burgerdev]

BREAKING: The Prometheus counter contrast_meshapi_attestation_failures_total is not incremented anymore if a workload has matching reference values but an untrusted policy hash. These rejections are now visible in the contrast_grpc_server_handled_total counter with field grpc_code=PermissionDenied.

---

The policy hash is passed as HOSTDATA on SNP and as MRCONFIGID on TDX. In the SNP validation, we used to check the HOSTDATA too, but we did not introduce this for TDX. As a consequence, the metrics observed on SNP and TDX are different: on SNP, an unknown hash ends up in attestation_failures_total, while on TDX it ends up in grpc_server_handled_total with an internal error status. Thus, we could not have a simple portable policy test that relied on the metrics.

This PR unifies handling of the policy hash between SNP and TDX by removing the additional validation from SNP. Existence of the hash in the manifest is now only checked in the NewMeshCert handler, where failures increment the grpc_server_handled_total with a PermissionDenied status. Now we can run the policy e2e test on all platforms.

Drive-by fix: the CLI now verifies coordinators on TDX correctly.