QE: plaintext includes PCK but no space for RIMs?

Hi y'all, I'm working on getting vendored firmware signatures into the hands of a user that has requested a quote.

Google has its own build of OVMF (with TDVF) that makes up the TDMR. This value means nothing unless we provide context through a golden measurement. It's best for this kind of information to not need an external server to provide. Every VM we start, we have another QE running, so each can have its own `ref_plaintext_ecdsa_data_sdk_t` with an added `platform_rim[SZ_8K]` or some such field for inclusion. We probably need more as more peripherals attest to themselves and CSPs have more cached certificates to provide.

In SEV-SNP, they have a GET_EXT_REPORT command that will give back a GUID table that the host populates with certificates, even host-defined ones. This is how we deliver the endorsement there. There is not counterpart in TDX except IIUC, the QE's plaintext that can be set with `store_cert_data`. The size there is strictly limited however.

I've seen discussion in Dan Williams' TSM patch series that Intel doesn't want to utilize a `certs` configfs entry that the host can populate, so I'm unsure how we can meet this need.