impl Send for VmInstanceRoT safely

[iximeow]

this does #55 but differently: @jordanhendricks noticed this earlier today as her main was a bit older than that commit, and the approach she'd taken is one we should go with.

I think the patches she'd written up for vm-attest are good to land, but I think she wanted to see them working propolis-side before doing PRs. this one's important enough I'm cutting the line, sorry Jordan :)

the unsafe impl Send here is very dangerous. since this code ends up in propolis, if VmInstanceRot was created with an OxAttest that is not Send, that's the pathway to a guest VM escape. really really bad. we need to not do that. adding + Send bounds gets Rust to check this stuff and gives a type error if code would have done something unsound.

[flihp]

Thanks for this @iximeow. I'm trying to learn async rust on the fly here so I appreciate pointers to better / right ways to do this.

[flihp]

I'm working w/ this code today. Since it's the weekend & I don't expect others to be online, I'm gonna squash and merge pretty quickly to keep the cherry-picking / rebasing to a minimum.