Initial Support for bare-metal QEMU-TDX runtime deployment

[msanft]

This adds initial support for deploying the Contrast runtime on bare-metal TDX machines with QEMU.

Notice that this does not yet contain full support for running Contrast on such platforms. Things that are left out as of now contain (non-comprehensive list):

• TDX attestation
• Policy generation and verification through the attestation
• Snapshotter support (Nydus / Tardev)
• Correct generation of the deployments with the right runtime handler name, which should be fixed with the follow-up for reading the runtime handler from the Manifest.

Due to the size of this PR, I encourage reviewers to see the commit messages for a more detailed description of what each commit does, and thus to review on a per-commit basis.

[katexochen]

PR is pretty big, can we split this into smaller chunks?

[msanft]

PR is pretty big, can we split this into smaller chunks?

As mentioned in the PR description, I split this into digestible commits already. What benefit do you see in splitting this up into multiple PRs instead of reviewing each commit? I think the changes are quite entangled, so without a merge queue or set-merging, this would be hard to split into chunks that make sense on their own, but not break main.

[msanft]

Please also address the comments from https://github.com/edgelesssys/contrast/pull/603

I think we should keep the pod-role annotation unique, as it is - besides the container image URL - the only way to see which installer is used.

[katexochen]

I think we should keep the pod-role annotation unique, as it is - besides the container image URL - the only way to see which installer is used.

We can add another annotation with the string value of what is now called flavour instead.