rune/sgx-tools: fix CVE-2019-11254

[haosanzi]

Need to update gopkg.in/yaml.v2 up to 2.2.8 to fix CVE-2019-11254,
rune/sgx-tools depends on github.com/urfave/cli v1.22.1, github.com/urfave/cli v1.22.1 depends on gopkg.in/yaml.v2 v2.2.2.

However the latested github.com/urfave/cli depends on gopkg.in/yaml.v2 v2.2.3 which has CVE-2019-11254.
In addition, urfave/cli must be <= v1.22.1 due to a regression: urfave/cli#1092.