Use IceCap + seL4 as a RealmOS for veracruz on CCA (and normal KVM while we wait for CCA FVP and associated firmware to become public)