Improve TPM DUK passphrase UX

Is your feature request related to a problem? Please describe.
There are two issues IMHO:

1. Capslock doesn't work, but there is no warning, so if the user enters the passphrase using capslock for some characters during setup, thinking that those characters are now capitalized and then later during passphrase entry on boot enters those characters with Shift instead of capslock, the passphrase won't be accepted, because it's not the same.
2. When the wrong passphrase (for TPM DUK) is entered the op fails immediately, falling back to recovery shell. Have mercy! Give the user at least another couple of tries in case of mistyping (is known to happen occasionally)...otherwise the presumably much more complex Disk Recovery Passphrase needs to be entered or a reboot triggered, which is bad UX.

Describe the solution you'd like
for 1.: either allow capslock under Heads or notify the user that capslock has no effect
for 2.: if TPM DUK unlocking fails due to bad passphrase, allow the user to retry a couple of times (maybe twice, so three tries in total).

Describe alternatives you've considered
Alternative for 1 is described above.
For 2: I guess returning to the main menu would be a better alternative than dropping to the recovery shell, though that may not be desirable as it makes it too easy to retry passphrases indefinitely.

Start by tracing the TPM DUK passphrase setup and boot unlock flows described in the issue. Define the Caps Lock behavior or warning and the retry behavior for an incorrect passphrase, then verify that mistyped TPM DUK entries no longer immediately force recovery while recovery remains available.