sev/i386: Enable an SEV-ES guest based on SEV policy