tpm2_unseal() returns -EUCLEAN specifically when a PCR kept being
extended while unsealing, but the unseal callers no longer catch it
via ERRNO_IS_NEG_TPM2_UNSEAL_BAD_PCR() and would fall back to the
generic "Failed to unseal secret using TPM2" message.
Give it a message of its own instead, so that the log points at the
actual cause instead of suggesting the system was tampered with.
Signed-off-by: Alberto Planas <aplanas@suse.com>
(cherry picked from commit 941db14b8e)