cli: add maa token to the output of verify command

[katexochen]

Proposed change(s)

• Adding the parsed Microsoft Azure Attestation token to the output of verify command. This is especially interesting to validate that the IDKeyDigest from the SEV-SNP report with the MAA.
• This is the first step to transition the SNP reporter from the current custom runner based workflow to a simpler verify based workflow in the CI.

Checklist

• Update docs
• Add labels (e.g., for changelog category)
• Is PR title adequate for changelog?

[thomasten]

I didn't look to deep in it yet, but this seems to re-implement things we do in go-azguestattestation with another library. Maybe we can just do this

constellation/internal/attestation/azure/snp/maa.go

Lines 51 to 55 in ee0adfe

	keySet, err := maa.GetKeySet(ctx, maaURL, m.client)
	if err != nil {
	return fmt.Errorf("getting key set from MAA: %w", err)
	}
	claims, err := maa.ValidateToken(token, keySet)

and print the returned claims?

[malt3]

I only reviewed the changes to CLI logic and did not review possible code overlap with go-azguestattestation

[katexochen]

I've added validation for the JKU from the token against the URL from the ID/config file.

I didn't look to deep in it yet, but this seems to re-implement things we do in go-azguestattestation with another library. Maybe we can just do this

constellation/internal/attestation/azure/snp/maa.go

Lines 51 to 55 in ee0adfe

	keySet, err := maa.GetKeySet(ctx, maaURL, m.client)
	if err != nil {
	return fmt.Errorf("getting key set from MAA: %w", err)
	}
	claims, err := maa.ValidateToken(token, keySet)

and print the returned claims?

The library isn't that versatile. Especially claims are only parsed as map of string, but the JWT is a nested struct, so sub-structs would still need to be parsed afterwards.

We could use maa.GetKeySet, but not sure it's worth the import.