cryptenroll: do not implicitly verify with default tpm policy signature

If it was not requested to use a tpm2 signature file when enrolling, do
not fallback to the default /run/systemd/tpm2-pcr-signature.json as it
likely will be unrelated if it exists.

Fixes https://github.com/systemd/systemd/issues/25435

src/cryptenroll/cryptenroll-tpm2.c

@@ -196,8 +196,9 @@ int enroll_tpm2(struct crypt_device *cd,
 
                 log_debug_errno(r, "Failed to read TPM2 PCR public key, proceeding without: %m");
                 pubkey_pcr_mask = 0;
-        } else {
-                /* Also try to load the signature JSON object, to verify that our enrollment will work. This is optional however. */
+        } else if (signature_path) {
+                /* Also try to load the signature JSON object, to verify that our enrollment will work.
+                 * This is optional however, skip it if it's not explicitly provided. */
 
                 r = tpm2_load_pcr_signature(signature_path, &signature_json);
                 if (r < 0) {