secboot: re-introduce v1 fde hook format

[valentindavid]

No description provided.

[bboozzoo]

LGTM

[valentindavid]

This was manually tested with

• snapd 2.49.2
• removing the assume in the pc gadget from latest/edge
• rebuild pc-kernel latest/edge with core-initrd core20 branch and snap-bootstrap from this PR
• core20 from latest/edge

[codecov]

Codecov Report

Attention: Patch coverage is 56.12245% with 43 lines in your changes missing coverage. Please review.

Project coverage is 78.85%. Comparing base (24018ee) to head (d3a6b29).
Report is 4 commits behind head on fde-manager-features.

Files with missing lines	Patch %	Lines
secboot/secboot_tpm.go	64.28%	23 Missing and 2 partials ⚠️
secboot/secboot_hooks.go	25.00%	9 Missing ⚠️
secboot/secboot_sb.go	43.75%	8 Missing and 1 partial ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           fde-manager-features   #14638      +/-   ##
========================================================
- Coverage                 78.87%   78.85%   -0.03%     
========================================================
  Files                      1092     1092              
  Lines                    147404   147483      +79     
========================================================
+ Hits                     116270   116298      +28     
- Misses                    23886    23935      +49     
- Partials                   7248     7250       +2     

Flag	Coverage Δ
unittests	78.85% <56.12%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[bboozzoo]

this feels like it's a leaky abstraction which only muddies the whole picture, could we do something more explicit, eg:

// legacy fde-hooks keys which did not carry any metadata
var legacyV1Key []byte
// more modern keys with metadata
var keys []*sb.KeyData

// isLegacyV1Key - simply checks the header

if fdeHasRevealKey() && isLegacyV1Key(sealedEncryptioKeyFile) {
	legacyV1Key, err = os.ReadFile()
	...
} else {
	if err := readKeyFile(sealedEncryptionKeyFile, loadedKey); err != nil {
		return res, err
	}
}

...
if len(legacyV1KeyFile) != 0 {

}
...
// continue with ActivateVolumeWithKeyData

and then simply drop the loader thingy

code changed