fix: Filter empty reference IDs at source instead of in loop

This addresses the reviewer feedback from @setrofim about treating the
root cause rather than symptoms. Empty reference IDs are now filtered
immediately after GetRefValueIDs() to ensure EvidenceContext.ReferenceIds
never contains empty strings, rather than skipping them later in the loop.

This is a cleaner approach that prevents the issue from propagating
throughout the system and maintains data integrity at the source.

Signed-off-by: Kallal Mukherjee <ritamukherje62@gmail.com>

Author: kallal79

vts/trustedservices/trustedservices_grpc.go

@@ -428,25 +428,28 @@ func (o *GRPC) GetAttestation(
 		return o.finalize(appraisal, err)
 	}
 
+	// Filter out empty reference IDs (can occur when no software components are provisioned)
+	filteredReferenceIDs := make([]string, 0, len(referenceIDs))
+	for _, refID := range referenceIDs {
+		if refID != "" {
+			filteredReferenceIDs = append(filteredReferenceIDs, refID)
+		}
+	}
+
 	appraisal.EvidenceContext.Evidence, err = structpb.NewStruct(claims)
 	if err != nil {
 		err = fmt.Errorf("unserializable claims in result: %w", err)
 		return o.finalize(appraisal, err)
 	}
 
-	appraisal.EvidenceContext.ReferenceIds = referenceIDs
+	appraisal.EvidenceContext.ReferenceIds = filteredReferenceIDs
 
 	o.logger.Debugw("constructed evidence context",
 		"software-id", appraisal.EvidenceContext.ReferenceIds,
 		"trust-anchor-id", appraisal.EvidenceContext.TrustAnchorIds)
 
 	var multEndorsements []string
 	for _, refvalID := range appraisal.EvidenceContext.ReferenceIds {
-		// Skip empty reference IDs (can occur when no software components are provisioned)
-		if refvalID == "" {
-			o.logger.Debugw("skipping empty reference ID", "refvalID", refvalID)
-			continue
-		}
 
 		endorsements, err := o.EnStore.Get(refvalID)
 		if err != nil && !errors.Is(err, kvstore.ErrKeyNotFound) {