Allow TCB levels to be accepted besides UpToDate

[OverOrion]

Proposed changes

This PR aims to give users the ability to accept different TCB levels. This can be useful in cases where the grace period has ended but for some reason (e.g. the BIOS update has not been relased yet) SWHardening could not take place.

Additional info

Currently a user needs to set both the command line flags and in the manifest as well. The command line flag was necessary for me as I could not find a way to extract the manifest values and inject them to the call site without major refactoring. Could you please give me some hints regarding this?

I was unable to run E2E tests via Kubernetes deployment because it seemed to me that some package (ego? era? not sure) were using the upstream version instead of my patched branch (I was using the provided Dockerfile in redis-gramine). This is likely a fault on my side, but wanted to mention it nevertheless. I would appreciate it if you could run E2E on it before merging.

[netlify]

✅ Deploy Preview for marblerun-docs canceled.

Name	Link
🔨 Latest commit	e399f62
🔍 Latest deploy log	https://app.netlify.com/sites/marblerun-docs/deploys/63bbfd98e8f74200085cb6a7

[CLAassistant]

All committers have signed the CLA.

[m1ghtym0]

Thank you @OverOrion!
This is a feature we had on the roadmap, perfect timing with your PR:-)

[daniel-weisse]

Changes look good to me, thanks
Just noted down some small style changes

Regarding having to set both CLI flags and manifest:
This is OK, and imo the correct way to implement this.

[daniel-weisse]

I was unable to run E2E tests via Kubernetes deployment because it seemed to me that some package (ego? era? not sure) were using the upstream version instead of my patched branch (I was using the provided Dockerfile in redis-gramine).

The dockerfile builds the premain from latest upstream source.

If you want to use a premain build from your changes instead, you can adjust the Dockerfile to pull from your repo

4c4
< RUN git clone https://github.com/edgelesssys/marblerun.git /marblerun
---
> RUN git clone --branch tcb-allow-list-pr https://github.com/OverOrion/marblerun.git /marblerun

Alternatively, you could also just copy the built premain into the container directly, instead of building it in docker:

37c37
< COPY --from=build-premain /premain/build/premain-libos /gramine/CI-Examples/redis/
---
> COPY ./premain-libos /gramine/CI-Examples/redis/

[OverOrion]

Changes look good to me, thanks Just noted down some small style changes

Regarding having to set both CLI flags and manifest: This is OK, and imo the correct way to implement this.

Thank you for the quick review, I have addressed them and did a force push (it seemed like the way how it is expected to be done in previous PRs).