feat(tvix/castore/blobsvc): validate StatBlobResponse

All chunks must have valid blake3 digests. It is allowed to send an
empty list, if no more granular chunking is available.

Change-Id: I7ecb53579cdf40fd938bb68a85685751b4d3626f
Reviewed-on: https://cl.tvl.fyi/c/depot/+/10726
Tested-by: BuildkiteCI
Reviewed-by: Connor Brewster <cbrewster@hey.com>
Autosubmit: flokli <flokli@flokli.de>

tvix/castore/src/blobservice/grpc.rs

@@ -129,6 +129,10 @@ impl BlobService for GRPCBlobService {
             Err(e) => Err(io::Error::new(io::ErrorKind::Other, e)),
             Ok(resp) => {
                 let resp = resp.into_inner();
+
+                resp.validate()
+                    .map_err(|e| std::io::Error::new(io::ErrorKind::InvalidData, e))?;
+
                 if resp.chunks.is_empty() {
                     warn!("chunk list is empty");
                 }