security: make cnf.jwk<->report_data binding fatal for SEV-SNP/TDX; fix TDX report_data offset

[imran-siddique]

Tracked follow-up from the June 2026 org-wide security hardening review. Wave 1/2 fixes are merged and published; this is remaining hardening.

For SEV-SNP/TDX the cnf.jwk<->report_data binding is currently advisory (non-fatal) and the TDX report_data is read from a best-effort/likely-wrong offset. Extract report_data from the parsed raw_evidence at the correct documented offset and require it to equal jwk_thumbprint(cnf.jwk.x); a mismatch must be fatal for all hardware platforms.

[imran-siddique]

Status: the cnf/report_data binding is now fail-closed via PR #386 (SNP). The TDX report_data offset will be pinned by the capture script's known report_data prefix (cmcp-tdx-fixture-v1) once the Azure TDX quote fixture lands; the TDX scaffold PR carries a skipped test that asserts the offset then.