Add HMAC-based LUKS2 auth

[alexhulbert]

No description provided.

[Copilot]

Pull Request Overview

This PR implements HMAC-based LUKS2 authentication by adding header integrity verification using HMAC-SHA256. The changes enable detached LUKS header storage with MAC verification to protect against header tampering.

Key changes:

• Adds HMAC-based header verification using SHA256 for LUKS2 authentication
• Implements detached header workflow with MAC storage on disk
• Refactors disk setup and mounting to use header verification

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 10 comments.

File	Description
tdx-init.go	Adds headerFile constant for temporary header storage
passphrase.go	Implements HMAC verification functions and refactors LUKS operations to use detached headers with MAC authentication

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[alexhulbert]

I'm going to go ahead and merge this, but I'm not going to update the Bob image until I get the green light from @astarinmymind