Add support for Loose Seal

Sealing keys, specifically the EGETKEY instruction, is a widely used component in SGX, but it's not present in TDX at all. The [gramine-sealing-key-provider](https://github.com/MoeMahhouk/gramine-sealing-key-provider) restores this, so we could integrate it to make use of sealing keys.

The consequence of no sealing keys is that right now the Replicatoor has no "local persistence" across process restarts. Except for the requestKey/receiveKey flow, there is no way for a replicatoor instance that has crashed to restart.

This means for example that a 1-node cluster can not tolerate crashes at all. There's no one to recover from!

Similarly, no matter how many in an N-node cluster, if they all crash at once there's no way to recover.

Normally in SGX we use a "sealing key", a persistent key accessible through "EGETKEY" that is uniquely derived for each application binary (mrenclave). So if you crash and restart the application it still gets the same one.

## Proposed integration plan

The best place to implement this is when generating the session key "myPriv". Instead of generating an ephemeral one, we should try to fetch from the loose seal.

We need to configure reaching looseseal by hostname:port, reaching from the app container to a service running on the host.

One challenge is that LooseSeal needs to run in the host, the implementation should ideally make it easy to fall back to a local one for development.

- [ ] add config option for looseseal hostname:port
- [ ] When generating a key in `requestKey`, refer to this to retrieve a key
- [ ] As a backup, accept a hardcoded debug key. This is part of fixed config.
- [ ] Optional: make a non-persistent key. We can use it in debug, but then it's kinda fragile

Commencez par suivre la génération de session-key et le flux de requestKey, puis examinez comment la configuration parvient à l’application container. Définissez la configuration hostname:port pour LooseSeal, le fallback de debug-key et le development mode facultatif non persistant. Le travail est considéré comme terminé lorsqu’un redémarrage peut récupérer le session-key via LooseSeal et que le développement local dispose toujours d’un fallback documenté.

Rédigé par le modèle d'indexation à partir du texte de l'issue.