fix(verifier): check the image manifest with one strict sha256sum grammar, in-process

[kvinwang]

The downloaded image's entire content binding is sha256sum -c sha256sum.txt plus its exit status. Reproduced against coreutils 9.4:

ca978112...  a.txt
0000000000000000000000000000000000000000000000000000000000000000 b.txt   <- one space
$ sha256sum -c sha256sum.txt
a.txt: OK
sha256sum: WARNING: 1 line is improperly formatted
exit=0

b.txt is never checked and the command succeeds. validate_image_manifest_paths uses split_whitespace(), so it accepts the single-space line, and prune_unlisted_image_files also uses split_whitespace().nth(1), so it treats b.txt as listed and keeps it. The file is then measured — bzImage, ovmf.fd, initrd — with no content check at all.

More divergences between the two grammars, all reproduced: <hash> *bzImage makes GNU check bzImage (binary-mode marker) while the whitespace split sees *bzImage, so the file that is checked is the one that gets pruned; <hash> name junk and \<hash> name diverge; CRLF and uppercase hex are accepted by GNU while str::lines() strips the \r.

And a third grammar over the same file: dstack_types::sha256sum_entry_hash matched the second whitespace token and ignored the rest, so trailing tokens were dropped and near-duplicates evaded its duplicate-entry check.

accepted "239f59ed...  measurement.tdx.cbor  junk\n"            (dstack-types)
accepted "44136fa3...  metadata.json\n0000...0000 bzImage\n"     (verifier)

Unified into one grammar rather than just adding --strict. We generate the file ourselves with sha256sum <files> (os/image/assemble.sh), so the new dstack_types::sha256sum module accepts only that output: newline-terminated <lowercase sha256> <name> lines, no blank lines, no duplicates, names from [A-Za-z0-9._-] starting with an alphanumeric. sha256sum::entry_hash goes through the same parser. The verifier now hashes each listed file in-process instead of shelling out, which removes the subprocess and the parse differential.

Overlaps with #1248, which fixes sha256sum_entry_hash more narrowly (take the whole remainder of the line as the filename). This supersedes it; take one or the other, not both.

Verification

cargo test -p dstack-verifier -p dstack-types -p dstack-mr -p dstack-attest -p dstack-kms -p dstack-vmm green; clippy clean under the CI invocation. All 43 meta-dstack release manifests from v0.5.1 on parse; the older ./name manifests stay rejected, as they already are on next.

The other verifier fixes originally bundled here were split out into #1332, #1333, #1334 and #1335.