Measuring GPU device firmware

Nobody has claimed this yet.

**Is your feature request related to a problem? Please describe.**

I was thinking about buying a new laptop with a GPU and use it with Qubes.
But in the https://github.com/Dasharo/dasharo-issues/issues/1087 @marmarek is rightfully concerned that a VM which has control over the GPU could flash the firmware of it.

I was wondering if it would be possible to authenticate the GPU ROM/flash content hash as well.

I assume reading the GPU flash requires a proprietary Nvidia binary. But it could be authenticated as well before it is run.

**Describe the solution you'd like**

- Add Nvidia flash reader as blob
- On boot:
- authenticate flash reader
- read and hash GPU ROM/flash content
- authenticate hash with TPM
- On failure inform the user about it.

**Describe alternatives you've considered**

- Measuring the OptionROM (vendor provided driver on the PCI device for UEFI (intro: https://blog.davidv.dev/posts/pcie-option-rom/ and `EFI_DEFERRED_IMAGE_LOAD_PROTOCOL` docs: https://uefi.org/specs/UEFI/2.10/36_User_Identification.html?highlight=efi_deferred_image_load_protocol#deferred-execution)): https://github.com/linuxboot/heads/issues/2004#issuecomment-3362712961
- Trust the authentication the GPU does before it writes it's flash.
- Yolo into it and ignore the security hole.

**Additional context**

https://github.com/Dasharo/dasharo-issues/issues/1087

Start by reviewing the related Dasharo issue 1087 and the linked OptionROM discussion before assessing the proposed approach. The request considers an authenticated Nvidia flash reader, GPU ROM/flash measurement, TPM authentication, and user notification on failure; done would require a decided implementation path for these steps.

Written by the indexing model from the issue text.