Refactor: runtime package

[chris-ricketts]

Summary:

• Split runtime.go (1,303 → 363 lines) into servers.go, tls.go, network.go, dek.go, ssm.go, ssm_ttl_cache.go, migrate.go
• Renamed viproxy_setup.go → network.go
• Merged imds.go into aws_clients.go
• Merged transport.go, middleware.go, runtime_handlers.go into servers.go
• Replaced acme.go with acme_cache.go
• Merged nitriding_config.go into config.go
• Replaced policy_builder.go with kms_policy.go; verification of PRC0 gated actions now only allows previous and/or current PCR0
• Replaced storage.go with dek.go
• Replaced signature.go; PCR0 signature loading absorbed into environment/nsm
• Rewrote nsm.go; added attestation option plumbing
• Added interfaces between subsystems (KVStore, RuntimeState, Migrator, DEK, etc.) to hide struct fields across files
• Removed go-chi/chi; routing via net/http.ServeMux
• Added nitriding/system_darwin.go for local builds
• New tests: nsm_test.go, kms_policy_test.go, logging_test.go, servers_test.go, migrate_test.go, dek_test.go, ssm_test.go, ssm_ttl_cache_test.go, kms_test.go, acme_cache_test.go
• Consolidated RESP/kvstore test suites; shared fakes moved to utils_test.go
• Net: prod 10,562 → 9,945 lines; tests 5,960 → 6,544;

Incorporates changes from #133 and #135

[aruokhai]

We already have state Root, wondering why this is necessary