fix(certgen): omit attestation extension when no challenge provided

AOSP KeyMint only includes the attestation extension (OID
1.3.6.1.4.1.11129.2.1.17) when ATTESTATION_CHALLENGE is present.
Without a challenge, generateKey produces a plain self-signed cert.
Our code unconditionally added the extension, which behavioral
probes detect by generating a key without a challenge and checking
for the OID.

Fixes both the Rust native-certgen and BouncyCastle paths.
Also skips AAID computation when no challenge is provided,
matching keystore2 security_level.rs:457 behavior.

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -708,7 +708,8 @@ class KeyMintSecurityLevelInterceptor(
 
             val attestVersion = AndroidDeviceUtils.getAttestVersion(securityLevel)
             val keymasterVersion = AndroidDeviceUtils.getKeymasterVersion(securityLevel)
-            val appId = AttestationBuilder.createApplicationId(callingUid)
+            val hasChallenge = params.attestationChallenge != null
+            val appId = if (hasChallenge) AttestationBuilder.createApplicationId(callingUid) else null
 
             val config = CertGenConfig(
                 algorithm = params.algorithm,
@@ -734,7 +735,7 @@ class KeyMintSecurityLevelInterceptor(
                 bootKey = AndroidDeviceUtils.bootKey,
                 bootHash = AndroidDeviceUtils.bootHash,
                 creationDatetime = System.currentTimeMillis(),
-                attestationApplicationId = appId.octets,
+                attestationApplicationId = appId?.octets ?: ByteArray(0),
                 moduleHash = if (attestVersion >= 400) AndroidDeviceUtils.moduleHash else null,
                 idBrand = params.brand,
                 idDevice = params.device,

app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt

@@ -238,10 +238,11 @@ object CertificateGenerator {
         if (keyUsageBits != 0) {
             builder.addExtension(Extension.keyUsage, true, KeyUsage(keyUsageBits))
         }
-        // Add our custom, simulated attestation extension.
-        builder.addExtension(
-            AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
-        )
+        if (params.attestationChallenge != null) {
+            builder.addExtension(
+                AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
+            )
+        }
 
         val signerAlgorithm =
             when (signingKeyPair.private.algorithm) {