This change introduces federated_select and its secure counterpart
as new intrinsics. As of this change, federated_select is still not
supported by any TFF backend (mapreduce, reference, or execution).
The purpose of this change is to solidify the API for federated_select
and unblock efforts to begin simulating federated_select for research
use.

Note that federated_select and federated_secure_select are
exposed as separate intrinsics rather than a single intrinsic whose
behavior is configurable in the backend, or as a single intrinsic with
a boolean parameter. The former approach would not allow for easy
simultaneous use of federated_select and federated_secure_select in
the same computation, which may be useful when selecting based on
private data in some places and non-private data in others. The latter
approach (a boolean parameter) could suggest to users that they should
parameterize their own code based on a "secure" boolean, which is
undesirable; such indirection could make it harder to tell whether
secure selection is being used in a particular location. Additionally,
keeping `federated_secure_select` as a separate function will make it
easier to modify if it turns out that `federated_secure_select` or
`federated_select` should offer additional non-shared parameters.

PiperOrigin-RevId: 367265514