vtpm: Add two-layer SealedBlob (AES-256-GCM + TPM2_Seal)

Adds VtpmState (serializable view of the persistent TPM state needed
across cold boots) and SealedBlob — a packed binary container
combining two encryption layers:

  Layer 1: AES-256-GCM over the serialized VtpmState. Key + nonce are
           derived from a caller-supplied entropy bundle (the kernel
           init path uses dual-source HKDF).

  Layer 2: TPM2_Seal of a small (60-byte) key bundle holding the AES
           key, GCM tag and nonce. This keeps the TPM-sealed payload
           well below RSA-2048 size limits while still binding the
           bulk data to a TPM-resident parent key.

The packed container is self-describing (magic + version + counter +
PCR digest + length-prefixed sections + SHA-256 trailer) so it can be
written through SealedBlobStore (commit 4) and read back unchanged.

Anti-rollback support: an HMAC-bound monotonic counter is part of the
header so storage backends that share a counter across tenants
(NV index pool) can still distinguish per-VM blob versions.

Signed-off-by: Goodleon-Y <goodleon3@126.com>

Author: Goodleon-Y

kernel/src/vtpm/mod.rs

@@ -10,6 +10,9 @@
 /// TPM 2.0 command construction over a pluggable transport (used to proxy
 /// commands to a TPM endpoint outside the CVM).
 pub mod proxy;
+/// Two-layer container (AES-256-GCM + TPM2_Seal of a key bundle) for
+/// persisting vTPM state across cold boots.
+pub mod sealed;
 /// Pluggable storage backend for the sealed vTPM blob.
 pub mod sealed_store;
 /// TPM 2.0 Reference Implementation