ε-CON: implement deployment restrictions

[ccicconetti]

The ε-ORC enforces the following requirements, specified as function annotations:

• deploy a single instance (currently, this is implicitly verified since there is no horizontal scalability)
• deploy the function only on nodes belonging to a set of UUIDs
• deploy the function only on nodes matching a set of classes, which are advertised by the nodes themselves
• deploy the function only on nodes that host a set of resources, identified through their names
• deploy the function only on nodes running in a TEE
• deploy the function only on nodes with TPM, which therefore perform authenticated registration

This requires adding the following node capabilities:

• classes (array of strings)
• is_tee_running (bool)
• has_tpm (bool)