chore(gateway)!: remove insecure_skip_attestation

[kvinwang]

Stacked on #1147. One commit, 12 files, +15 / -32.

Problem

core.debug.insecure_skip_attestation turned off the two checks that make a
gateway cluster mean anything:

• the app_id a node presents on its RPC certificate (main.rs skipped asking
  the guest agent for it entirely, leaving my_app_id as None);
• the peer identity behind every WaveKV sync and push, and behind
  ensure_from_gateway.

With it set, any client that could reach the sync routes could insert entries
that replicate to every gateway in the cluster.

It existed for one reason: the integration suites could not run without it.
That reason is gone — #1147 gives them a guest agent simulator and verifies
quotes through the normal production path — so nothing sets it any more.

Leaving it in place would leave a setting that a copied config can carry into
production, in a component whose whole job is to be the cluster's trust
boundary. docs/security/security-model.md argues that dstack's development
switches are acceptable because they are visible in attestation measurements
or public contract state. That argument does not extend to this one: it is
what decides whether attestation happens at all.

Fix

Deleted: the field, the three code paths that read it, the two config files
and two documents that mention it, and the pattern for it in the full-stack
suite's forbidden-settings audit. The audit keeps the other four patterns;
there is simply no longer a setting to catch.

One stale comment goes with it — authorize_peer's doc referred to "the
attestation bypass" as the half of verify_gateway_peer a test cannot reach.
Now only Rocket's certificate guard is.

Breaking change

A deployment that set core.debug.insecure_skip_attestation = true now
attests its peers. The config struct does not use deny_unknown_fields, so
the leftover line is ignored rather than rejected. What happens next
depends on why it was set:

• On a TDX host with a guest agent — the gateway starts normally, and peers
  that cannot present a verifiable app_id stop being accepted.
• On a host with no guest agent, which is the usual reason to have set it —
  the gateway no longer starts at all. main now asks the guest agent for
  this node's app_id unconditionally and fails with Failed to get app info.
  This is deliberate: my_app_id is what every peer check compares against, so
  a gateway that cannot learn its own identity must not come up without one.

Either way: remove the line and make sure every node can attest.

There is no replacement, deliberately: a gateway that cannot attest its peers
is not a cluster it is safe to join.

Verification

cargo test -p dstack-gateway --all-features: 308 passed / 0 failed, on this
branch and on its base, so the deletion changes no test outcome.

The three integration suites were run on this exact tree — this is the state
they were verified against in #1147:

Suite	Result	Exit
cluster/	40 passed / 0 failed	0
e2e/	42 passed / 0 failed	0
proxy-e2e/	136 passed / 0 failed	0

grep -rn insecure_skip_attestation over the repo: 0 hits.

Follow-up: the identity is now non-optional (cda064e)

Review found that the deletion left my_app_id as Option<Vec<u8>>, and that
one consumer still failed open on None: cert_validator was built with
my_app_id.map(...), and HttpsClient::new treated a None validator as
"standard verification" — plain CA-path validation with no app_id check on
every outgoing WaveKV sync connection. That was the outbound half of the very
switch being removed, still reachable by construction.

Tightened the whole way down: Proxy/ProxyOptions carry Vec<u8>,
HttpsClientConfig::cert_validator is Arc<dyn CertValidator> and
HttpsClient::new lost its validator-less branch, and authorize_peer takes
&[u8]. Chain verification against the CA still runs first — the validator is
an identity check on top of it, not a replacement.

a_gateway_without_an_app_id_authorizes_nobody is deleted; it asserted what
the type system now guarantees. The https_client transport tests mint an
app-id leaf and a matching validator rather than opting out, so they now
exercise the real verifier path.

cargo test -p dstack-gateway --all-features: 307 passed / 0 failed (308 minus
the deleted test). cargo clippy --all-targets and cargo fmt --check: clean.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.