efi/preinstall: Check that TPM's platform hierarchy is disabled or has an authorization value

The TPM's platform hierarchy is under the control of the platform firmware. Before executing any third-party code, the platform firmware should prevent use of the platform hierarchy by the OS, by doing one of the following:

- Set the authorization value for the platform hierarchy to a random value with `TPM2_HierarchyChangeAuth`
- Disable the platform hierarchy with `TPM2_HierarchyControl`

These are both reset on the next TPM restart or reset.

The pre-install checks should test for this and return an appropriate error if the platform firmware is not behaving as expected.

Locate the pre-install checks and the existing TPM handling in this Go repository. Read how TPM hierarchy state and errors are currently represented, then verify the platform hierarchy's authorization or disabled state using the specified TPM2_HierarchyChangeAuth and TPM2_HierarchyControl behavior. Done means an appropriate error is returned when neither expected condition is met.

Written by the indexing model from the issue text.