Add explicit SEV-SNP measurements policy

[deeglaze]

trafficstars

When reference values come from a small database, allow checking against values that are known ahead of time, without needing to check signatures.

This allows the Google Attestation Verifier to use its reference measurements database without needing to trawl all the signed reference values we published.