feat: Add GCP TDX support with event log compatibility fix

[lalalune]

• Fix cc-eventlog to handle GCP's 0-based IMR indices using saturating_sub
• Add Terraform configuration for GCP Confidential VMs (Intel TDX)
• Add deployment scripts and comprehensive test suite (12 tests)
• Add Base Sepolia network to hardhat config
• Full backward compatibility with Phala/standard TDX deployments

Tested on GCP c3-standard-8 with real Intel TDX hardware attestation.

Feel free to just pick out the fixes to the lib.rs since that's the main actual fix

[h4x3rotab]

Very good start point. It pulls the GCP's in-stock Ubuntu image, and install the dstack agent and docker runtime in the VM startup script. It largely works because GCP CC VM also offers standard TDX attestation API.

The missing pieces in this approach:

• The base image is not reproducible, which is necessary to establish the chain-of-trust of OS code provenance
• The startup scripts needs a way to be attested
• dstack-kms needs to understand the attestation produced by GCP. Note that in GCP, there are more components like vTPM included in the TCB. So it's necessary to verify it in full.
• Integrate with other dstack components like dstack-vmm and dstack-gateway

There's a tracking issue that covers the missing pieces: #125