efi: support HP pre-OS PCR measurements

[ebrig]

Summary

HP firmware can produce two pre-OS measurements that are not currently represented in generated EFI PCR profiles:

• a vendor-defined PCR2 event after EV_SEPARATOR, but before the initial OS loader is authorized or launched
• an EV_EFI_ACTION in PCR7 containing the enabled SVM and DMA protection configuration when additional DMA settings are measured to PCR7

This causes the generated profile to diverge from the TPM values and prevents a resealed key from unlocking normally.

This change:

• replays vendor-defined PCR2 events only within the interval between the PCR2 separator and the first OS authorization or application launch
• requires that an OS boundary is observed rather than accepting a truncated log
• recognizes HP's exact enabled SVM/DMA/all-PCIe pre-boot protection event in PCR7
• validates the PCR7 event digest and accepts the event only once, before Secure Boot configuration measurements
• applies the same rules in profile generation and preinstall validation

Hardware validation

Tested on an HP ZBook Ultra G1a 14 inch Mobile Workstation PC with BIOS X89 01.05.07 (2026-05-05), using:

• SVM CPU Virtualization: Enable
• DMA protection: Enable
• Pre-boot DMA protection: All PCIe devices
• Measure Additional DMA Settings: PCR7

After resealing with the patched package, TPM-passphrase unlock succeeded across a reboot.

Tests

• GOTOOLCHAIN=go1.23.12 ./run-tests --with-mssim
• go build ./... with Go 1.18.10 and Go 1.23.12
• go vet with Go 1.18.10 and Go 1.23.12
• focused PCR2 and PCR7 tests with Go 1.18.10 and Go 1.23.12

[ebrig]

@chrisccoulson @valentindavid, would either of you be able to review this when you have a chance?