cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match

When we enroll two UKIs with different PCR pub keys into one LUKS slot/
token each, then we can encounter the wrong one and should not give up
but continue iterating instead of requiring the passphrase. Similarly,
a pcrlock token might be for another UKI and we should continue the
search. Same for a token that is meant for another TPM (e.g., external
storage). While this is mainly about cryptsetup's automatic unlocking
from the initrd, it also matters for usage in the system, e.g., for
other storage and when cryptenroll should unlock using the TPM.
There are two code paths, one is the libcryptsetup plugin and the other
is the fallback when that's not available.
To let the libcryptsetup loop continue to iterate, remap the above
error conditions to EPERM. For the fallback path check all of them (no
remapping) and continue iteration. For better log output, include the
token ID to be able understand which token fails.

src/cryptenroll/cryptenroll-tpm2.c

@@ -260,7 +260,10 @@ int load_volume_key_tpm2(
                                 &decrypted_key);
                 if (IN_SET(r, -EACCES, -ENOLCK))
                         return log_notice_errno(SYNTHETIC_ERRNO(EAGAIN), "TPM2 PIN unlock failed");
-                if (r != -EPERM)
+                /* Stop unless we should keep iterating to next token because the tried one
+                 * does not match boot state. For now without -EUCLEAN because currently the
+                 * only error it reports won't be solved by moving to another token. */
+                if (!ERRNO_IS_NEG_TPM2_TOKEN_MISMATCH(r))
                         break;
 
                 token++; /* try a different token next time */