coreboot
https://firmware.intel.com/learn/fsp/about-intel-fsp
http://blog.ptsecurity.com/2017/08/disabling-intel-me.html
1. cpu
SLAT (EPT) Intel VT-x
2. ram 32-64gb
3. video
integrated intel HD or nVidia Quadro (?)
4. SSD 1TB +
5. Disabled micro and webcam
Is that correctly ? such a laptop will cost about 2000 dollars, maybe its top Thinkpad workstation, but coreboot flashes only T2xx/T4xx old models.
Well, those requirements, I'd go for a W5XX, I believe it's the workstation series that should handle your requests.