Simplify may query field in CHURP SGX policy

The SGX policy structure was copied from the old key manager, where enclaves are mapped to runtime IDs. Since derived key shares are not bound to the caller's runtime ID, the hash map could be simplified to a vector of enclave identities. This would likely also allow us to remove the runtime ID from the key share request.

Note that all enclaves included in the policy are allowed to query all keys. This means that runtime A can query keys for runtime B if allowed by the policy. And this is fine, as this enables key sharing across different runtimes. Binding key shares to a runtime ID was considered as an alternative but was intentionally not adopted.

Start by tracing the SGX policy structure and the key share request implementation described in the issue. Determine how the runtime-ID map is used, then verify that a vector of enclave identities preserves the stated cross-runtime key-sharing behavior and whether the runtime ID can be removed from the request.