podvm-mkosi: provide attestation for reference measurements

[mkulke]

see #2363

We also want to provide signed reference measurements for the generic podvm-mkosi builds. The Azure images are built w/ TEE_PLATFORM=az-cvm-vtpm, so the measurements cannot be generic over all podvm-mkosi builds atm.