Fallback to non-TPM unique identifier if TPM not available

[agracey]

For systems without a TPM available (such as rpi), we need to be able to use a different identifier to help with the secure onboarding.

If we have a global trust root stored in Rancher, we could sign a hardware identifier and store it in a read-only partition. As long as this signature is loaded out of band or prior to hardware transport, we can trust the registration.

[mudler]

FYI we split tpm bits from rancherd/os2 in a separate library that can be used by both: https://github.com/rancher-sandbox/go-tpm and supports TPM emulation