tpm20: Move user copies outside the lifecycle lock

[kbowling]

Summary

tpm20: Move user copies outside the lifecycle lock

The TPM 2.0 character-device methods held the global device lock
while uiomove() accessed user memory.  User page faults could therefore
delay suspend or detach even though the read response was already
buffered.

Add a per-open sleepable lock to serialize operations on each response
buffer.  Stage commands under that lock before acquiring the device
lock, and copy them into the response buffer only after the lifecycle
checks succeed.  This preserves an unread response when suspend or
detach rejects a write.  Release the device lock before copying buffered
responses out.  Also advance the response offset by the bytes actually
copied when uiomove() returns after a partial transfer.

Validated on an Intel TPM 2.0 TIS device.  PCR reads and GetRandom
passed under 16-process mixed command load.  A response was consumed
correctly in 5-byte, 7-byte, and remainder reads.  Module unload/reload
recreated the device and entropy source without lock diagnostics.

MFC after:      2 weeks

[kbowling]

Apply uio finding from @kevans to tpm20