tpm2: support policies with PIN

Modify TPM2 authentication policy to optionally include an authValue, i.e.
a password/PIN. We use the "PIN" terminology since it's used by other
systems such as Windows, even though the PIN is not necessarily numeric.

The pin is hashed via SHA256 to allow for arbitrary length PINs.

v2: fix tpm2_seal in sd-repart
v3: applied review feedback

src/shared/creds-util.c

@@ -534,6 +534,7 @@ int encrypt_credential_and_warn(
 
                 r = tpm2_seal(tpm2_device,
                               tpm2_pcr_mask,
+                              NULL,
                               &tpm2_key,
                               &tpm2_key_size,
                               &tpm2_blob,
@@ -803,6 +804,7 @@ int decrypt_credential_and_warn(
                                 le32toh(t->blob_size),
                                 t->policy_hash_and_blob + le32toh(t->blob_size),
                                 le32toh(t->policy_hash_size),
+                                NULL,
                                 &tpm2_key,
                                 &tpm2_key_size);
                 if (r < 0)