DCAP attestation - bail on non-up-to-date TCB status

[ameba23]

During DCAP attestation verification, TCB status can have the following possible values:

• UpToDate
• SWHardeningNeeded
• ConfigurationNeeded
• ConfigurationAndSWHardeningNeeded
• OutOfDate
• OutOfDateConfigurationNeeded
• Revoked

dcap-qvl's verify function will reject an attestation if the status is 'Revoked' and succeed otherwise, giving us the status information and possible advisory IDs in the VerifiedReport.

Out current policy is to log a warning if the status is not 'UpToDate' and proceed with success anyway.

This PR changes that behavior to bail with an error if the status is not 'UpToDate'.

This is the most conservative approach, but it could possibly mean that configurations are rejected which are considered safe by the cloud provider.

A possible alternative approach to this would be to check TCB status in our PCCS implementation, so out of date

Note: It has been suggested to have a minimum time window for rejecting out of date TCB, so that providers have time to update before attestations are rejected. But i can't see a way we can get the date on which the TCB expired, without observing ourselves when attestations with the TCB are no longer accepted, which we could do as part of the PCCS implementation.

We do have access to various dates associated with collateral - but as far as i can see, none of these nessarily tell us when collateral became out of date:

• tcbDate - is the date associated with the TCB level, not the expiry date
• issueDate and nextUpdate - are the freshness window of the collateral document, not the TCB - so collateral with OutOfDate TCB status may still have a nextUpdate date in the future.