Don't try to be too clever on failure in UnsealFromTPM

Currently, UnsealFromTPM tries to determine between an invalid key file or a TPM provisioning issue, and executePolicySession goes even further - trying to determine whether the static metadata or PCR policy metadata is invalid, although that isn't exposed at the moment. I think this should just return a single error on unseal failure (InvalidKeyFile), and then it should be up to the running system to perform additional diagnostics (see https://github.com/snapcore/secboot/issues/33)

Start at UnsealFromTPM and executePolicySession, the entry points named in the issue, and trace how each currently distinguishes unseal and policy metadata failures. Done means unseal failure returns the single InvalidKeyFile error, with additional diagnostics left to the running system as described in the issue.

Written by the indexing model from the issue text.