WithSecureBootPolicyProfile should support systems that include new SPDM related measurements

These are described in newer versions of the TCG PFP spec (since 1.06), and currently unsupported by `WithSecureBootPolicyProfile`. The new pre-install checks will catch this and disable support for `WithSecureBootPolicyProfile`, but we will have to add
support for these new measurements at some point.

I'm not entirely sure what the intent for SPDM is at the moment - it provides a way for compatible devices to
provide their own attestations, so I'm not sure if this is a technology that's going to be targetted at devices or
more for the confidential computing case where it's useful to have devices exposed to a guest be able to provide
their own verifiable attestations.