tpm20: Validate suspend and resume commands

[kbowling]

Summary

The internal TPM2_Shutdown and TPM2_Startup paths ignored both transport
failures and the TPM response.  Suspend could therefore enter S3 without
saved TPM state, while resume could restart entropy harvesting after a
failed state restoration.

Build both commands through one helper, validate their response framing
and TPM return codes, and propagate failures.  Retry the standard RETRY
and TESTING responses with bounded exponential backoff.  Accept
TPM_RC_INITIALIZE from Startup because firmware may already have started
the TPM during resume.

Do not enter S3 after an unsuccessful state save, and do not restart the
entropy task when TPM state restoration failed.  If Shutdown fails after
the entropy task was drained, requeue it before returning so an aborted
suspend does not permanently stop harvesting.

MFC after:      2 weeks

[kevans]

sys/dev/tpm/tpm20.c

41–42

TPM2_CC_STARTUP is already in tpm20.h as TPM_CC_Startup (named to match the spec), so we just need TPM_CC_Shutdown there as well. I don't have a strong opinion about the other definitions being here vs. there, though.

48

This one's TPM_TIMEOUT_B, just with different units. IMO it's probably worth keeping the 'B' reference in there somewhere, even if it's just in the value, since that's another spec reference.