feat(certgen): add enforcement tags to native DER encoder and teeResponses cache

Extend Rust native cert gen with software-enforced attestation tags
(CALLER_NONCE, ACTIVE_DATETIME, ORIGINATION_EXPIRE_DATETIME,
USAGE_EXPIRE_DATETIME, USAGE_COUNT_LIMIT, UNLOCKED_DEVICE_REQUIRED)
and make NO_AUTH_REQUIRED conditional in teeEnforced. Fixes F5/F6
test failures where these tags were missing from NativeCertGen path.

Add teeResponses cache so PATCH mode keys patched in onPostTransact
return consistent attestation via getKeyEntry. Without this, getKeyEntry
fell through to real keystore2, returning unpatched metadata.

Remove dead Rust enums (KeyPurpose, SecurityLevel, VerifiedBootState)
that were never referenced by the DER encoder.

native-certgen/src/lib.rs

@@ -199,6 +199,14 @@ fn extract_config(env: &mut JNIEnv, config: &JObject) -> Result<CertGenParams> {
     let id_model = get_nullable_byte_array(env, config, "idModel")?;
     let id_second_imei = get_nullable_byte_array(env, config, "idSecondImei")?;
 
+    let active_datetime = get_long(env, config, "activeDatetime")?;
+    let origination_expire_datetime = get_long(env, config, "originationExpireDatetime")?;
+    let usage_expire_datetime = get_long(env, config, "usageExpireDatetime")?;
+    let usage_count_limit = get_int(env, config, "usageCountLimit")?;
+    let caller_nonce = get_boolean(env, config, "callerNonce")?;
+    let unlocked_device_required = get_boolean(env, config, "unlockedDeviceRequired")?;
+    let no_auth_required = get_boolean(env, config, "noAuthRequired")?;
+
     Ok(CertGenParams {
         algorithm: Algorithm::try_from(algorithm)?,
         key_size: key_size as u32,
@@ -238,6 +246,13 @@ fn extract_config(env: &mut JNIEnv, config: &JObject) -> Result<CertGenParams> {
         id_manufacturer,
         id_model,
         id_second_imei,
+        active_datetime,
+        origination_expire_datetime,
+        usage_expire_datetime,
+        usage_count_limit,
+        caller_nonce,
+        unlocked_device_required,
+        no_auth_required,
     })
 }
 
@@ -253,6 +268,10 @@ fn get_long(env: &mut JNIEnv, obj: &JObject, name: &str) -> Result<i64> {
     Ok(env.get_field(obj, name, "J")?.j()?)
 }
 
+fn get_boolean(env: &mut JNIEnv, obj: &JObject, name: &str) -> Result<bool> {
+    Ok(env.get_field(obj, name, "Z")?.z()?)
+}
+
 fn get_byte_array(env: &mut JNIEnv, obj: &JObject, name: &'static str) -> Result<Vec<u8>> {
     let field = env.get_field(obj, name, "[B")?.l()?;
     if field.is_null() {