### Description

This PR adds one more check on the nonce value in the cross-site token
verification stage. The nonce is embedded into `reported data` for
snpguest report and nonce parameter in the client of nvtrust. At
verification stage, the nonce is extracted from the received tokens,
compared with previously received tokens. If it matches any, then this
token is considered an used one, which is likely a replay attack to the
system. Therefore, the verification will fail.

### Types of changes
<!--- Put an `x` in all the boxes that apply, and remove the not
applicable items -->
- [x] Non-breaking change (fix or new feature that would not break
existing functionality).
- [ ] Breaking change (fix or new feature that would cause existing
functionality to change).
- [ ] New tests added to cover the changes.
- [x] Quick tests passed locally by running `./runtest.sh`.
- [ ] In-line docstrings updated.
- [ ] Documentation updated.