attestation API suitable for use from (faux-)?mgs

[flihp]

The current interface / IDL from the Attest and Sprot tasks currently works over the SWD probes. I've been thinking of this API as experimental since we don't expose it outside of the SP / over MGS yet. The humility hiffy interface is effectively the API to this and it's only consumer is the verifier-cli tool here: https://github.com/oxidecomputer/dice-util/tree/main/verifier-cli. This is a start but it's not sufficient for use from pilot racktest in the way we need for manufacturing: https://github.com/oxidecomputer/facade/issues/115

This issue is intended to track the work in hubris required to expose the attestation API off-platform for use by things like (faux-)?mgs and pilot racktest.

[lzrd]

#1946 takes a measurement of the SP and records it with the attest task.