fix(tpm-qvl,nsm-qvl): bound collateral fetching from untrusted URLs

[kvinwang]

tpm-qvl and nsm-qvl fetch collateral before the quote is verified, from URLs in certificates the caller supplies: the TPM AK certificate's AIA and CRL distribution points, and every certificate in an NSM document's cabundle. Nothing bounded that work:

• tpm-qvl followed AIA links in an unconditional loop, so an endless chain never returns.
• Both tried every CRL distribution point and read response bodies without a size limit.
• nsm-qvl's async reqwest::get had no timeout at all: one hanging distribution point stalls a Nitro verification forever.

The duplicated CRL download code moves into a new pki-fetch crate. Its Fetcher gives each collateral fetch one budget: 30s total, 16 requests, 4 MiB of bodies, with each request also capped at 10s so a hanging endpoint falls through to the next. Bounding requests, rather than chain depth or distribution points per certificate, covers the AIA loop, long distribution-point lists and an arbitrarily long cabundle alike. Real fetches use a fraction of it: GCP makes 3 requests (2 AIA hops, one 765-byte CRL), AWS Nitro 2.

tpm-qvl moves from blocking to async reqwest: capping the body means streaming it, and the blocking client's Read restarts its timeout on every read. This also drops the spawn_blocking hop and the nested runtime the mock-attestation test needed.

No host allowlist: everything these endpoints serve still has to chain to the pinned platform root CA, so pinning hosts adds no attestation security. The verifier can still be made to GET attacker-chosen (including internal) addresses before the quote is verified; restricting which networks it may reach is an operator-side egress control.

Note: TEST_FETCH_CRL=1 in nsm-qvl fails on next too — the fixture's regional CRL URL now returns 403.