Add json measurement output option and generic TDX attestation type to make CLI similar to cvm-reverse-proxy

[ameba23]

This PR adds two CLI-facing improvements in order to behave more similar to cvm-reverse-proxy's attested-get:

1. --allowed-remote-attestation-type tdx now accepts any TDX platform attestation (dcap-tdx, qemu-tdx, gcp-tdx, azure-tdx).
2. get-tls-cert can optionally write attestation measurements to a file via --out-measurements.

It also extends certificate retrieval internals to return both certificate chain and optional measurements.

Key changes

1. Added MeasurementPolicy::tdx() convenience constructor.
2. Updated CLI parsing to map allowed_remote_attestation_type=tdx to that policy.
3. Extended get_tls_cert API to return (cert_chain, measurements).
4. Added --out-measurements <path> on get-tls-cert and persisted returned measurements.

Known caveat

--out-measurements currently writes header-format JSON (from to_header_format()), which is different from --measurements-file policy schema.

[ameba23]

Pairs with BuilderNet/website#78