cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match

cryptsetup/cryptenroll: Iterate over TPM tokens when they don't match

When we enroll two UKIs with different PCR pub keys into one LUKS slot/
token each, then we can encounter the wrong one and should not give up
but continue iterating instead of requiring the passphrase. Similarly,
a pcrlock token might be for another UKI and we should continue the
search. Same for a token that is meant for another TPM (e.g., external
storage). While this is mainly about cryptsetup's automatic unlocking
from the initrd, it also matters for usage in the system, e.g., for
other storage and when cryptenroll should unlock using the TPM.
There are two code paths, one is the libcryptsetup plugin and the other
is the fallback when that's not available.
To let the libcryptsetup loop continue to iterate, remap the above
error conditions to EPERM. For the fallback path check all of them (no
remapping) and continue iteration. For better log output, include the
token ID to be able understand which token fails.