Design IMP exec verification steps

[grondo]

Verification of IMP input for the exec subcommand is largely detailed in RFC 15. The privileged part of the IMP, after receiving input in struct kv format, will need to determine validity and integrity of the signed input from from the guest user as well as the validity of the "owner" (real UID executing the IMP) to request resources described in the input, and whether or not they have been granted authorization to run the guest's job (or whether they are allowed to run the IMP at all).

Some mechanisms used here may be described in existing issues here, e.g. verification of public cert (#43) and the basic verification APIs. This issue is for design and implementation of the high-level verification steps within the privileged part of the IMP.