fix(certgen): omit attestation extension when no challenge provided

AOSP KeyMint only includes the attestation extension (OID
1.3.6.1.4.1.11129.2.1.17) when ATTESTATION_CHALLENGE is present.
Without a challenge, generateKey produces a plain self-signed cert.
Our code unconditionally added the extension, which behavioral
probes detect by generating a key without a challenge and checking
for the OID.

Fixes both the Rust native-certgen and BouncyCastle paths.
Also skips AAID computation when no challenge is provided,
matching keystore2 security_level.rs:457 behavior.

native-certgen/src/lib.rs

@@ -62,11 +62,14 @@ fn generate_attested_inner(env: &mut JNIEnv, config: &JObject) -> Result<jbyteAr
 
     let keybox = keybox::parse_keybox(&params.keybox_cert_chain, &params.keybox_private_key)?;
 
-    let attest_ext = attestation::build_attestation_extension(&params)?;
+    let attest_ext = match params.attestation_challenge {
+        Some(_) => Some(attestation::build_attestation_extension(&params)?),
+        None => None,
+    };
 
     let cert_chain = certbuilder::build_certificate_chain(
         &key_pair,
-        &attest_ext,
+        attest_ext.as_deref(),
         &keybox,
         &params,
     )?;