Bundle DCAP collateral together with attestation to avoid fetching on the verifier side

[ameba23]

This is a possible solution to #58

In order to avoid needing to do a network fetch to retrieve DCAP collateral during verification, in this PR the attester fetches collateral at the point of DCAP attestation generation, and includes it in the evidence payload.

Since collateral is signed by Intel it does not matter from a trust perspective whether it is provided by the (untrusted) attester or retrieved by the verifier.

The advantage is we do just one PCCS fetch per attestation regardless of how many times it is verified, even if the verifications are by different remote peers.

The disadvantages:

• This is an API breaking change,
• Increases payload size/complexity
• Diverges from standards
• Is quite opinionated / use-case-specific. This specifically caters to a nuance in our attested-tls protocol, making the attestation crate less useful as a general purpose library.

For these reasons i am not suggesting we merge this, but i wanted to provide a complete possible solution.