Allow setting attestation types without expected measurements in measurements file

In some cases we might want to enforce that the remote party uses a particular attestation type, but not the expected measurements (so that these can be checked upstream via header injection).

Example:
```json
[
    {
        "measurement_id": "dcap-tdx-any",
        "attestation_type": "dcap-tdx",
        "measurements": null,
    } 
]
```

Currently this would be rejected.