Introduce IVmCapabilitiesService HAL

This HAL can be used to provide vendor-specific extensions to VMs. First
use case for this HAL is custom smc filtering project, which provides a
way for some vendor-owner VMs to allow issue vendor-specific smcs. See
go/pkvm-pvm-allow-vendor-tz-services-access for more details

Bug: 360102915
Test: presubmit
Change-Id: Iaf8e3e066f5bda9eae079252720860d362d14426