Add SgxIdentityExpectation and auxillary messages
Add SgxIdentityExpectation and auxillary messages

This commit adds the `SgxIdentityExpectation`, `SgxIdentityMatchSpec`,
and `SgxMachineConfigurationMatchSpec` messages, intended to closely
resemble `CodeIdentityExpectation` and related messages.

The reasoning behind mirroring the hierarchy found in the `CodeIdentity`
messages (ie. introducing `SgxIdentityMatchSpec` which consists solely
of the composition of the two children match specs, rather than just
adding them as two additional fields to `SgxIdentityExpectation`) is
because the `code_identity_util` API currently contains methods that
operate on "match spec"-level messages; therefore, it makes the most
sense to maintain this parity, since `SgxIdentity` is intended to
eventually replace existing instances of `CodeIdentity`.

PiperOrigin-RevId: 263855701
Change-Id: I156a95fb86043925a003fc479e128b9a83cc1d23

google/asylo,google/asylo,google/asylo,google/asylo,google/asylo,google/asylo