Dynamic search of ek keys with ekCertificates

[cviecco]

This patch allows ek keys to be searched in additional persistent key handle locations. And to return the actual Certificate and handle mapping when the keys in the handles do not match the default values.

Unifies creation of EK and allows listing of high certs if present.

Rationale:
During the deployment of some newer lenovo systems the default rsa handle comes with a 3k key which prevents attestation from working as built. Thus the need for the library to create the 2k key in a separate location in case the default location is already occupied and there is no 2k on the standard locations.

Today, there is no support for RSA 3k on the codebase. Among other things there is need for adding the 3k storage EK handles, and their templates. Initial exploration with these returned a bad policy error. 3k issues should be resolved in a different PR

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[liamjm]

Can we have some tests of this, using the setupSimulatedTPM() as a starting point?

[liamjm]

Nice work, just some small nits, otherwise LGTM.

[mjg59]

It would be helpful to describe why the 3K certificate attestation fails - that's not made explicit in the description, but would help justify the modifications.

[cviecco]

@mjg59 I added some of the issues found around 3k certs in the description. In short:

1. The current code does not search for the expected 3k (or p384) cert locactions.
2. Even after adding these and adding the appropiate templates I am still getting failing policy when attempting to do the ActivateCredential call. Since I have only one system with these (and I have been also unable to do it with a squennce of tpm2_tools calls) I am thinking it maybe an issue with the implementation on the harware side. However I am not confident enough on my knowlege to claim this.

I have been able to do self attestation test against with p256 and rsa2048 AK endordorsed by p256 or rsa2048 ek.