fix #5858: tpmstate: allow excluding the TPM state from backups

Disks can be excluded from backups with the 'backup' flag, but the TPM
state does not support it. Guests can keep secrets in the TPM, like
the key to automatically unlock disk encryption, so a backup that
includes the TPM state can be enough to get at the data. Users might
want to keep the TPM state out of the backup and rely on a recovery
key after restoring instead.

Add the 'backup' flag to the TPM state, like for other disks. Backups
already honor it for all volumes of the configuration, so a TPM state
with 'backup=0' is skipped and logged as excluded in the backup task
log, and on restore, its line is commented out like for other excluded
disks.

Signed-off-by: Michal Fox <me@dualfroz.com>

src/PVE/QemuServer/Drive.pm

@@ -594,6 +594,7 @@ my $tpmstate_fmt = {
         description => "Disk size. This is purely informational and has no effect.",
         optional => 1,
     },
+    backup => $drivedesc_base{backup},
     %tpmversion_fmt,
 };
 my $tpmstate_desc = {

src/test/parse-config-input/tpmstate-no-backup.conf

@@ -0,0 +1,16 @@
+# VM with a TPM state that is excluded from backups
+bios: ovmf
+boot: order=scsi0;net0
+cores: 2
+efidisk0: local-lvm:vm-8006-disk-0,efitype=4m,ms-cert=2023k,pre-enrolled-keys=1,size=4M
+machine: pc-q35-10.1
+memory: 4096
+name: win11
+net0: virtio=BC:24:11:3E:8A:D1,bridge=vmbr0
+ostype: win11
+scsi0: local-lvm:vm-8006-disk-1,size=64G
+scsihw: virtio-scsi-single
+smbios1: uuid=5b1f3c7e-2d4a-4c8e-9f6b-7a3e1d2c4b5f
+sockets: 1
+tpmstate0: local-lvm:vm-8006-disk-2,backup=0,size=4M,version=v2.0
+vmgenid: 6a7d2f3e-1b4c-4d5e-8f9a-0b1c2d3e4f5a

src/test/run_parse_config_tests.pl

@@ -26,7 +26,7 @@ my $OUTPUT_DIR = './parse-config-output';
 my $EXPECTED_DIR = './parse-config-expected';
 
 # NOTE update when you add/remove tests
-plan tests => 2 * 10;
+plan tests => 2 * 11;
 
 sub run_tests {
     my ($strict) = @_;