feat(dstack-mr): add UEFI disk boot (UKI) measurement support

[kvinwang]

Summary

Add --uki flag to dstack-mr for UEFI disk boot measurement, enabling pre-computation of TDX measurements for the boot path: OVMF → systemd-boot → UKI → vmlinuz.

This is needed by dstack-k8s which boots from a GPT disk with systemd-boot + Unified Kernel Image, instead of QEMU's -kernel direct boot.

Changes

• Machine struct: Add uki, bootloader, disk optional fields. When uki is set, UEFI disk boot measurement path is used.
• uefi_boot.rs (new): RTMR[1] and RTMR[2] computation for UEFI disk boot
• tdvf.rs: Add rtmr0_log_uefi_disk() with correct BootOrder (2 entries) and Boot0001 (disk device)
• acpi.rs: UKI-specific ACPI table generation (single disk + net, no vsock/9p)
• kernel.rs: Make authenticode_sha384_hash pub(crate) for reuse
• CLI: Add --uki, --bootloader, --disk flags; skip initrd=initrd append in UKI mode

Measurement model (verified against TDX hardware)

Register	Events	Source
MRTD	OVMF firmware pages	Unchanged
RTMR[0]	14 events: TD HOB, CFV, EFI vars, ACPI, BootOrder(2 entries), Boot0000, Boot0001	tdvf.rs
RTMR[1]	8 events: "Calling EFI App", separator, GPT, systemd-boot auth, UKI auth, vmlinuz auth, ExitBootServices x2	uefi_boot.rs
RTMR[2]	2 events: cmdline (UTF-16LE), initrd hash	uefi_boot.rs

Key differences from -kernel mode:

• RTMR[1]: 3 EFI app Authenticode hashes (systemd-boot, UKI, vmlinuz) instead of patched kernel
• RTMR[2]: cmdline as UTF-16LE (Linux EFI stub), no initrd=initrd append
• RTMR[0]: BootOrder has 2 entries, Boot0001 added for disk device
• Boot variable digest = SHA384(variable_data_bytes), not SHA384(UEFI_VARIABLE_DATA struct)

Usage

dstack-mr measure metadata.json -c 2 -m 4G --qemu-version 8.2.2 \
  --uki dstack-k8s.efi \
  --bootloader BOOTX64.EFI \
  --disk dstack-k8s.raw

Test plan

• MRTD matches TDX hardware
• RTMR[0] matches TDX hardware (all 14 events)
• RTMR[1] matches TDX hardware (all 8 events)
• RTMR[2] matches TDX hardware (both events)
• Existing -kernel mode unchanged (no --uki flag = original behavior)
• CI test with UKI artifacts (needs test fixtures)