This PR introduces one notable change, and works around two delicate subtleties.

First, we restrict the use of WAMR + SGX to SGX v2 only. This is to ensure we can use SGX's dynamic memory management features. This means that, to run in HW mode, we need:

• An Intel IceLake server (or greater)
• A host kernel > 6.0 (EDMM was upstreamed with the in-kernel SGX driver then).

Second, this PR addresses two gritty issues that arise when transferring a lot of data in-out of the enclave.

1. Transferring via an [out] buffer in an OCall is limited to the size of the untrusted app's stack, so we must, sometimes, use an [in] buffer in an ECall, as these use the heap of the enclave (which can now grow dynamically with EDMM).
2. Transferring big data in, usually involves malloc-ing data inside the WASM module (via wasm_runtime_module_malloc in WAMR), which in turn can call the memory.grow opcode, which may invalidate native pointers to WASM offsets. We must be careful with that.

closes #681