make rococo relaychain work as shielding target

[brenzi]

closes #1539

use rococo relay chain for shielding/unshielding and ROC as native token on sidechain

• introduce 3 instances of parentchain pallet in sgx-runtime to keep track of each
  • the shard vault is guaranteed to only be initialized on one of the parentchain pallet instances
• STF can send extrinsics to (only) the parentchain selected by --shielding-target (See let STF access metadata for all parentchains #1568 for context)

goals:

• choice of shielding/unshielding target is made with cli arguments by the primary validateer upon shard init. that also defines the native token of the sidechain stf
  • shard_vault written to one of 3 parentchain pallet instances in stf-runtime
  • abort if cli argument conflicts with pre-initialized shard leftover task: test target_a provisioning completeness #1569

testing

Goal: perform ROC shielding from local rococo relay to sidechain and unshield back to rococo relay

# on host
zombienet-linux-x64 spawn --provider native zombienet/rococo-local-with-integritee.toml

# console on docker
./integritee-service -c -u ws://172.17.0.1 --target-a-parentchain-rpc-url ws://172.17.0.1 --target-a-parentchain-rpc-port 9999 run --skip-ra --dev --shielding-target target_a &> worker1-rococo.log

# next docker console
alias relay="./integritee-cli -u ws://172.17.0.1 -p 9999" 
alias integritee="./integritee-cli -u ws://172.17.0.1"
read MRENCLAVE <<< $(integritee list-workers | awk '/  MRENCLAVE: / { print $2; exit }')
echo $MRENCLAVE
alias incognitee="./integritee-cli -u ws://172.17.0.1 trusted --mrenclave $MRENCLAVE"
read VAULT <<< $(incognitee get-shard-vault)
echo $VAULT
relay transfer //Charlie $VAULT 12000000000000
incognitee balance //Charlie
# should be ~12 units after a while
incognitee --direct unshield-funds //Charlie //Charlie2 1000000000000
relay balance //Charlie2
# should be ~1 unit after a while

expected failures

start seconf SCV without target_a specified

./integritee-service -c -u ws://172.17.0.1 -d ./worker2 -P 3000 -w 3001 -r 3444 -h 4546 run --skip-ra --dev &> worker2-rococo.log

• starts, gets provisioned, proxy is added on tagret_a by SCV1, but SCV2 can't propose blocks (this is good):

  �[0m�[38;5;8m[�[0m2024-01-10T12:08:17.065661Z �[0m�[1m�[31mERROR�[0m 
  enclave_runtime::error�[0m�[38;5;8m]�[0m Returning error NoTargetAParentchainAssigned as sgx unexpected.
  [ 2024-01-10T12:08:17.065Z ERROR integritee_service::sidechain_setup] Sgx(SGX_ERROR_UNEXPECTED)
  

now, we supply target_a endpoint, but still omit --shielding-target. this should fail too

• it does fail, but for the wrong reason:

  �[0m�[38;5;8m[�[0m2024-01-10T12:14:54.509445Z �[0m�[1m�[31mERROR�[0m itc_parentchain_light_client::finality�[0m�[38;5;8m]�[0m Block 31 contained invalid justification: InvalidFinalityProof(BadJustification("invalid signature for precommit in grandpa justification"))
  �[0m�[38;5;8m[�[0m2024-01-10T12:14:54.509698Z �[0m�[1m�[31mERROR�[0m itc_parentchain_block_importer::block_importer�[0m�[38;5;8m]�[0m [TargetA] Header submission to light client failed for block number 31 and hash 0xc7b64259d51c484312722587eb748ef44600279778003fdf41365f80f7452f5d: InvalidFinalityProof(BadJustification("invalid signature for precommit in grandpa justification"))
  �[0m�[38;5;8m[�[0m2024-01-10T12:14:54.509812Z �[0m�[1m�[31mERROR�[0m enclave_runtime�[0m�[38;5;8m]�[0m Error synching parentchain: 
  ParentchainBlockImportDispatch(BlockImport(LightClient(InvalidFinalityProof(BadJustification("invalid signature for precommit in grandpa justification")))))
  

  this shall be fixed elsewhere: Rococo-runtime as target-a panics upon parentchain sync #1547

next step would be to supply a correct --shielding-target and then it should work, even if we shut down SCV1 and retry the shielding-unshielding cycle. Left for #1569

[brenzi]

seems to work for parachain target_A, but for rococo-relay, I ran int: #1547

[brenzi]

M6 fails for shard vault because the enclave is not a proxy of vault. seems to be a bug in defaulting to Integritee as shielding-target...
aha, not enough funds... TEER deposits massively higher than on ROC

[clangenb]

Some minor comments, but all in all it looks great! I actually thought, this will be harder to achieve.