docs(proofs): clarify verification scope of attestation and proof verification

[emostov]

What

Docs-only change to proofs/src/lib.rs (rustdoc comments; no behavior changes):

• parse_and_verify_aws_nitro_attestation / parse_and_verify_der_attestation: add warnings that these verify AWS Nitro PKI/COSE authenticity only and do not validate PCR identity, user_data, or manifest policy against expected/pinned values.
• verify(app_proof, boot_proof): document its actual scope (AWS attestation, envelope approval self-consistency, manifest/user_data linkage, ephemeral-key linkage, PCR0-3/PCR17 vs the supplied manifest) and warn that the supplied manifest contents, manifest-set members, and threshold are NOT compared to an independently pinned Turnkey trust anchor.
• Fix stale rustdoc link in unsafe_attestation_doc_from_der (attestation_doc_from_der -> parse_and_verify_der_attestation).

All warnings point to https://github.com/tkhq/qos for the canonical verification checks.

Verification

cargo fmt --check
cargo test -p turnkey_proofs   # 5 unit tests + 1 doctest pass
cargo doc -p turnkey_proofs --no-deps   # no warnings