pcrlock: log if we generate an "empty" policy

pcrlock: log if we generate an "empty" policy

Such a policy won't provide any protection, but it's still entirely fine
to have it like this in various contexts, for example at OS install
time, to allocate the nvindex and reference it in enrollments. However,
it does deserve mention, hence log about it at LOG_NOTICE level.

This is based on a similar patch by Arnaud Patard
<arnaud.patard@collabora.com> proposed at #33663.