create rootfs_key dynamically and seal it

[mythi]

We have been waiting for #20 but in the mean time, let's work on something simpler to get rid of the static rootfs_key.

The proposal is to create rootfs_key dynamically and seal with with MRSIGNER key from Occlum's getkey ioctl().

Steps:

• update boot-instance Occlum to 0.29.7 #126
• improve payload image creation v2 #114
• update image-rs Occlum snapshotter to make the key available under the containerd_id path
• update runtime boot to get the key from containerd_id path

[dcmiddle]

@piotrpalcz fyi

[Xynnn007]

Let me try to understand this:

1. Enclave-agent generates a key randomly, seal the key and then put the encrypted key to /run/enclave-cc/<containerd_id>
2. runtime boot get the key from /run/enclave-cc/<containerd_id> and unseal it

This implies that the enclave-agent and runtime boot are signed by the same signer, right?

[mythi]

@Xynnn007 yes your summary is correct

[ariel-adam]

@mythi will this converge for release 0.7.0 (feature freeze 12th of July) or should we move this to 0.8.0?