Add option to make input image public

[georgwiese]

Right now, images are always private, which makes sense if it is additionally verified, e.g. by checking the signature of an attested sensor. For other use-cases (i.e., purely outsourcing computation), the verifier will actually want to check that the right image was used.

We should support both use-cases. During key generation, there should be a flag to publish the input (which basically adds a bunch of equality constraints to the instance column).