Policy sessions need to know authValue for parameter encryption

According to Part 1, 21.1: Session-based encryption introduction:

> If a session is also being used for authorization, sessionValue (see 21.2 and 21.3) is sessionKey || authValue. The binding of the session is ignored. If the session is not being used for authorization, sessionValue is sessionKey.
>
> NOTE 1 A policy session that is used for parameter encryption uses authValue to calculate sessionValue even if the policy does not include TPM2_PolicyAuthValue().

This means we need to hook in some way for a caller who's using a policy session for authorization and parameter encryption with an object with non-empty auth value, to pass that auth value, in an ergonomic way.

Start with the cited Part 1, section 21.1, and trace the policy-session parameter-encryption entry points in go-tpm. Determine how a caller can provide an object's non-empty authValue when the policy omits TPM2_PolicyAuthValue(), then confirm the API remains ergonomic and covers both authorization and parameter encryption.

Written by the indexing model from the issue text.