Expose identity cert chain from RoT over SpRot

[flihp]

When programming with staging keys we leave the SWD port open & have been using this to validate the identity certs programmed. We can't use this mechanism when production signing because the SWD port on the RoT will be disabled. There are still open questions as to the ergonomics required by the mfg system but at the bare minimum we need a method to get this data out of the RoT by way of the SPI bus using 'SpRot'.

[flihp]

Getting #1378 merged is the first step in this work. I've got a WIP that modifies the sprot & the sprot servers in SP & RoT to send the required messages but this needs the attest task in place to work.

[flihp]

WIP currently blocked on #1378: https://github.com/oxidecomputer/hubris/tree/rotr-rebase-sprot