fix(types)!: checked log indices, unambiguous digests and DSSE verifier binding

[wolfv]

Stack: follows #198 (then #185).

• Make LogIndex construction fallible; propagate invalid untrusted Rekor indices instead of panicking.
• Require essential fields when constructing TlogEntryBuilder, removing its invalid default.
• Decode DigestBytes JSON as base64 only; provide an explicit from_hex constructor. Accept ProtoJSON base64 alphabets/padding for byte fields.
• Bind DSSE v0.0.1 logged verifiers to caller-supplied managed keys even when tlog inclusion verification is skipped, and check the payload hash algorithm.

Validation: workspace all-feature tests and strict all-target Clippy passed; regressions include a valid managed-key DSSE signature with correct, substituted and malformed logged verifiers.

Breaking: LogIndex::new returns Result; use TryFrom instead of From. TlogEntryBuilder::new requires entry fields. Hex digest JSON must be migrated to base64.