Mitigate the certificate chain extension attack.

This changes the extraction of the attestation from the certificate
chain.  Instead of unconditionally extracting the attestation in the
leaf certificate (if present), the code now walks up the certificate
chain to the root, only taking into account the last attestation
extension it finds (i.e., the one closest to the root).

This mitigates an attack in which an attacker crafts a new leaf
certificate with a seemingly good attestation and appends it to the
certificate chain.

Now createParsedAttestationRecord takes a List (the whole certification chain instead of just the leaf. Since we need to find the one contains the attestation data which is nearest to the root certification. Change CTS to reflect the new updated API

Bug: 268544173
Test: manual
(cherry picked from https://android-review.googlesource.com/q/commit:e9b85287e05219d0f2153764cfdd23e7f54c3c63)

Merged-In: If1d5fb1456406fe48e50c4f424808c5a7943c3c7
Change-Id: If1d5fb1456406fe48e50c4f424808c5a7943c3c7