bruschetta: Handle dynamic policy updates

This requires that we keep track of which VMs are running and what
policy was used when they were launched. Whenever the policy changes
we compare the new policy to the old policy to figure out which VMs
must be shut down.

This also adds a late-stage check to BruschettaLauncher matching the
check in the installer to prevent launching a VM if the enterprise
policy changed at the last minute, mostly because we now need to look
at the policy at that point anyway.

Also start enabling vtpm usage where allowed by policy, and for alpha VMs.

Bug: b:266648016, b:231900967
Change-Id: I5e396ba30041f7078a25973addddaff9bdb2f20a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4202269
Reviewed-by: David Munro <davidmunro@google.com>
Auto-Submit: Fergus Dall <sidereal@google.com>
Commit-Queue: David Munro <davidmunro@google.com>
Cr-Commit-Position: refs/heads/main@{#1100289}