Add _at_time variants for deterministic testing against real fixtures

[crow (crow-004)]

Summary

validate_cert_trust_chain and validate_and_parse_attestation_doc both validate against the real system clock, with no way for a downstream consumer to override it: get_epoch()'s FAKETIME override is #[cfg(test)]-gated inside this crate, so it never compiles into the published library. That makes it impossible for a crate depending on this one (as a normal library dependency, not via #[cfg(test)]) to write a deterministic test against a real, previously-captured attestation document — a real Nitro leaf certificate is only valid for a few hours (this crate's own test comments note ~3), so such a test would start failing on its own a few hours after the fixture was captured, for no actual code reason.

This PR adds validate_cert_trust_chain_at_time and validate_and_parse_attestation_doc_at_time: the same logic, parameterized by an explicit now: u64 instead of calling get_epoch() internally. The existing functions become thin wrappers calling the new ones with get_epoch()? — no behavior change, purely additive, nothing existing is touched.

Why this came up

I'm building an independent attestation-verification CLI that depends on this crate. I wanted to write a genuine positive test ("a real captured document verifies successfully") instead of only testing rejection paths, and ran into exactly the limitation above — confirmed by reading this crate's real source (not assumed), including the fact that this crate's own tests already hit the same ~3-hour wall and work around it with FAKETIME, which simply isn't available outside #[cfg(test)].

Testing

• Added two new tests using this crate's own existing real fixture (test-data/beta/valid-attestation-doc-bytes), deliberately NOT asserting a specific pass/fail outcome tied to that fixture's own validity window (an earlier draft of this PR did exactly that, using the ~3-hour-old "approximately 15:15" timestamp this file's own comment records, and it failed — the comment's "approximately" turned out to matter). Instead:
  • validate_and_parse_attestation_doc_at_time_matches_the_real_clock_entry_point_given_the_same_now: proves the new function agrees with the existing one when given an equivalent "now", regardless of whether the fixture is currently expired.
  • validate_and_parse_attestation_doc_at_time_rejects_a_real_doc_at_the_unix_epoch: proves the time parameter has real effect (1970 predates every real Nitro cert).
• Confirmed this PR introduces no new test failures: a clean, unmodified checkout of main already has the same 6 pre-existing time_sensitive test failures locally without FAKETIME set (matches your own CI config providing it) — not something this PR causes or is in scope to fix.

Happy to adjust naming/shape if you'd prefer a different API (e.g. accepting webpki::Time directly, or a builder-style config) — went with the smallest, most obviously-safe additive change.

🤖 Generated with Claude Code