Add nonce to iOS attestation and enforce one-time use.

This change introduces a nonce field in the IosAttestationData proto. The server now checks if the provided nonce has been used before, rejecting requests with reused nonces. The nonce is also included in the content bindings when calling IosGuard's Decode RPC.

PiperOrigin-RevId: 895555506

quiche/blind_sign_auth/proto/attestation.proto

diff --git a/quiche/blind_sign_auth/proto/attestation.proto b/quiche/blind_sign_auth/proto/attestation.proto
index 31e31ea..7ab2f56 100644
--- a/quiche/blind_sign_auth/proto/attestation.proto
+++ b/quiche/blind_sign_auth/proto/attestation.proto
@@ -111,6 +111,9 @@
 
   // Device ID for quota checking.
   string device_id = 3;
+
+  // Nonce returned from the server and added to the content bindings.
+  bytes nonce = 4;
 }
 
 message AttestationData {