Enable Secure System Time

[kvinwang]

According to the doc from Intel, the TSC inside TD is secure if it is synchronized with NTS.

This PR makes the TD system time secure by:

• Disabling kvm-clock so that the TD guest kernel uses TSC as the only clock source.
• Synchronizing the system time using chrony with NTS in initrd, if it fails, rejecting to boot.
• Adding chrony as a systemd service

TODO: Terminate the system upon prolonged chrony synchronization failure to prevent clock drift.

[heytdep]

Awesome. Initially I thought that it was better to rely on the app-layer to infer the tsc which would add more security (e.g make sure the host isn't delaying) but after some thinking the app-layer can still do this extra security check with this approach + it seems TDs are not actually allowed to modify the vTSC iiuc from the module spec. Just putting this here for context in case some other folks were thinking about this too.