pcrlock: add "is-supported" verb that checks if the local TPM supports the commands we need for pcrlock

systemd-pcrlock requires support for the PolicyAuthorizeNV command,
which is not implemented in the first TPM2 releases. We also strictly
require SHA-256 support. Hence add a tool for checking for both of
these.

This is a tighter version of "systemd-analyze has-tpm2", that checks for
the precise feature that systemd-pcrlock needs, on top of basic TPM2
functionality.

Fixes: #37607

test/units/TEST-70-TPM2.pcrlock.sh

@@ -52,6 +52,7 @@ set -e
 test $ret -eq 1
 
 SYSTEMD_COLORS=256 "$SD_PCRLOCK"
+"$SD_PCRLOCK" is-supported
 "$SD_PCRLOCK" cel --no-pager --json=pretty
 "$SD_PCRLOCK" log --pcr="$PCRS"
 "$SD_PCRLOCK" log --json=pretty --pcr="$PCRS"