[sidechain] enable permissioned validateer sets per shard/MRENCLAVE

[brenzi]

For various reasons it may be desirable to whitelist validateers either through onchain governance or by the initiator of a sidechain

• latency: to reach sub-second block times for geo-local use cases, a permissionless setup won't do because validateers may be spread globally.
• jurisdiction: Some sidechains will need to run within certain jurisdictions (i.e. GDPR requirements)

it is not yet defined, who will have the authority to whitelist, so we may want to support several scenarios

[brenzi]

solved in #201