Ensure SERVTD_ATTR used in bind operation by VMM matches expectation before destination MigTD accept the incoming LM

[bodzhang]

According to Intel TDX LM architect, during LM, the destination MigTD should check VMM used the expected SERVTD_ATTR value to bind with the local TDCS of the incoming tenant CVM. As the destination VMM is supposed to bind the destination MigTD with the local TDCS for the incoming tenant CVM before invoking the GHCI request to the destination MigTD to approve the LM, destination MigTD should be able to read the tenant CVM's SERVTD_CUR_ATTR in the local TDCS of the tenant CVM. If the value is not as expected, destination MigTD should abort the LM by not setting the MSK.