Conflict with TPM-backed Full Disk Encryption

[jbicha]

See this report:
https://discourse.ubuntu.com/t/ubuntu-23-10-asking-for-tpm-recovery-key-on-every-boot-after-firmware-update/40656

[tim-hm]

Ideally our firmware-updater GUI would disable itself if TPM backed FDE is detected and firmware updates are not supported. But given the the firmware-updater is a strictly confined snap I'm unaware of a mechanism for it to tell if TPM backed FDE is in use. Additionally, fwdup is also on the system so a user can still attempt an update from the CLI.

I think a complete solution here is to support firmware updates with TPM-backed FDE and if there's a straightforward mechanism, then disable updates on tpm backed fde machines.

[superm1]

Related is this issue with deb fwupd: canonical/ubuntu-desktop-installer#2371 and this one with snap fwupd: fwupd/fwupd#6264