Attest Luks

Rotate LUKS passphrases for new-format VMs (version >= 1.3.0).

DEPRECATED: superseded by POST /provision, which does the same storage rotation and additionally records the VM root CA identity. Kept unchanged for legacy in-field VMs; retire once the fleet upgrades.

The VM embeds the luks_quote_nonce (received in the boot attestation response) in a TDX quote after extending RTMR3 in initramfs. require_luks_quote_nonce validates and consumes the nonce; the handler then calls verify_quote which checks the TDX signature and all RTMR measurements including RTMR3. Returns rotated passphrases, the k3s encryption key, and a confirm nonce.