Add initial support for SVSM vTPM-based attestation

[deeglaze]

trafficstars

This is not a complete solution because the initial SVSM attestation protocol only supports binding to a storage EK. Both "AK" and "gceAK" conflict with this. There is no attestation and verification flow in go-tpm-tools for AKs that are certified by a CA with ActivateCredential. It is out of scope of this PR to add support for that.

As for the proposed SVSM_ATTEST_SINGLE_SERVICE_EX protocol addition that I expect to be usable from Linux with a "manifest_selector" configfs report attribute (https://github.com/deeglaze/amdese-linux/commits/vtpm612ex/), we have yet to get any specification update from AMD on how far their SVSM spec will diverge from my proposal implemented in https://github.com/coconut-svsm/svsm/pull/719