WithBootManagerCodeProfile needs changes to accommodate TCG PFP spec v1.06

Previous versions of the TCG PFP spec describe a `EV_EFI_ACTION` event "Calling EFI Application from Boot Option" optionally measured to PCR4 before the first launch event. If this exists in the current log, we copy it to the computed profile.

v1.06 of this spec adds an additional `EV_EFI_ACTION` event - "Booting to Option". Whilst the current `WithBootManagerCodeProfile` will also copy this event to the computed profile if it exists in the current log, there needs to be an API to specify which boot entry will be used to boot a specific path so that we predict the correct PCR values, rather than just blindly copying the entry in the log, which might contain the wrong boot number. This needs coordinating with whatever is writing to BootXXXX, BootOrder and BootNext variables.

Right now, the pre-install checks I'm working on will detect this and disable support for `WithBootManagerCodeProfile`, but we need to fix this fairly urgently

---

On 19 August Robert Lui (Taipei) discussed this with Snapd:
`FDE setup failure on Lenovo thin clients with remote provisioning`
- TCG events contain a fallback event (USB disk → internal NVMe disk) which secboot lib doesn’t support
- [PCR4 EV_EFI_ACTION Boot-Fallback Report](https://docs.google.com/document/d/1PEYi7i1ngpigMV9YgJ96OjF31UD3jMF4at5R_peEVnc/edit?tab=t.0#heading=h.fxl4inpk9zip)