Permit owner clear in some contexts

We made a recent change to make tpm2 sealed keys that don't use a PIN or passphrase not DA-protected, so that they are still accessible if the TPM enters lockout mode. We should go one step further for devices that don't use passphrase or PIN protected keys and not disable owner clear during provisioning (ie, skip the call to `TPM2_ClearControl`).

This would make it possible for snapd to put the device into a state where it could be cleared using the `TPM2_Clear` command without any authorization, by setting the authorization value for the lockout hierarchy to the empty value from a running system (as long as there are no PIN or passphrase protected keys), which would then allow `TPM2_Clear` to be subsequently called without authorization in order to clear the TPM, where necessary. This would avoid the need to go via the PPI, which on devices that are intended to be used with a HID, generally requires a physical presence check and so can't be automated.

Start by locating the provisioning path that calls TPM2_ClearControl, then trace how it determines whether sealed keys use a PIN or passphrase. Done means owner clear remains enabled during provisioning when no such protected keys are present, while protected-key cases retain the existing behavior; verify the relevant provisioning tests if available.

Written by the indexing model from the issue text.