Add AMD SME/SEV enabling boot parameters

[raja-grewal]

As further hardening for professional and server CPUs, we should recommend enabling hardware-based encryption of physical memory. Note SME was enabled by default prior to kernel 5.15 but was disabled due to what appears to be a legacy and isolated issue concerning DMA masks.

I am proposing to add the following command line options:

mem_encrypt=on
kvm_amd.sev=1
vm_amd.sev_es=1
vm_amd.sev_snp=1

Please see Kicksecure/security-misc#338, Kicksecure/security-misc#341, and Kicksecure/security-misc#352 for some additional details.