fix: return 400 instead of 500 for validation errors

[felippemsc]

Summary

• Catch exceptions from signedshot.validate_with_jwks() and return 400 with a descriptive error message instead of a 500 stack trace
• Handles cases like old sidecars missing the attestation field and cross-issuer signature verification failures

Test plan

• Upload a sidecar with missing attestation field — should return 400
• Upload a sidecar from dev-api to api (or vice versa) — should return 400
• Upload a valid sidecar+media pair — should still return 200

[github-actions]

🚀 Release Candidate Deployed!

Version: v0.0.25-rc.43

The RC has been deployed to the dev environment. Check the /health endpoint to verify.