Protect Vault unseal keys using Nitro Enclaves and a cryptographic attestation

Secure enclaves like AWS Nitro Enclaves have some really cool properties that are used here:

- memory protection and isolation for Vault while it's running

- unsealing without the parent host getting the key (can't be observed)

- having an unseal key that can't be used unless inside the enclave via cryptographic attestation