CCA Verifier does not surface report_data

[fitzthum]

With EAR Tokens, a verifier must include a report_data field in the TCB Claims. If the verifier doesn't return this, the token that is generated won't have the public key in it (this would normally be covered by the report data). Technically we have required verifiers to do this for a long time but it has never been enforced.

For now you can still use simple tokens with CCA.

I took a quick glance at the CCA code and I wasn't really sure what value we should put into the report_data field. It would be better if an expert took a look.

cc @huoqifeng

[huoqifeng]

CC @kevinzs2048, @thomas-fossati @seungukshin @chendave