Support userspace TPM2 logs

Following #498, the natural solution is to enable `go-attestation` to read from `/run/log/systemd/tpm2-measure.log` to perform the replay operation.

After a conversation in the [UAPI group](https://uapi-group.org/specifications/) on its Signal group, there's no immediate appetite to stabilize anything because there's a lot to sort out and discover (atomicity, who locks, who can write, etc.). The end goal might be to expose some IPC primitive (probably Varlink) to talk with a component to get CEL event logs.

In the meantime, I'm not sure I see a reason NOT to try to observe the current unstable API on a best effort basis to successfully replay some of these PCRs.

This would close #498.

Start with issue #498 and the existing go-attestation replay operation; the issue names /run/log/systemd/tpm2-measure.log as the proposed input. Determine how the current log can be observed on a best-effort basis, then verify that relevant PCRs can be replayed without depending on an unstable future IPC API.

Written by the indexing model from the issue text.