Update inter-cluster instance move design with HMAC signatures

This also adds a large piece of pseudo code for explanatory purposes.

Signed-off-by: Michael Hanselmann <hansmi@google.com>
Reviewed-by: Guido Trotter <ultrotter@google.com>