`.dtbauto` measurements makes PCR11 useless as it becomes unpredictible

[arianvp]

The whole point of PCR-11 for UKI is that we have a PCR where we only measure things known at build time, so that we can generate policies for it with systemd-measure and ship those to the hosts.

However, it was decided (and implemented in systemd-stub) that only the selected matching .dtbauto section is measured into PCR-11

#123 (comment)

However, this break the predictability of PCR11! as the measured value depends on what hardware the UKI is loaded on!

I think we should revert back to measuring all .dtbauto into PCR11. And we should perhaps measure the finally selected dtb into another PCR.

Note that what devicetree actually gets used also depends on what PE addons are loaded; which means it might even be the case that whatever is measured into PCR11 is not what is loaded. Which is even more confusing.