Optee TAs

[brianmcgillion]

Optee TAs

[jmbaur]

Thanks for marking this issue. This is something I wanted to come back to after
adding the optee builds to this repo. There are definitely a few aspects of the
optee build we currently have that we want to cleanup. The tee-supplicant secure
filesystem (defaults to /data/tee), TA directory (defaults to /lib/optee_armtz),
and plugin path (defaults to /usr/lib/tee-supplicant/plugins) all being some of
the pieces that we can add NixOS options for in the module.

As for CFG_TEE_CLIENT_LOAD_PATH, maybe setting it to something hardcoded like
/var/lib/optee would suffice, then the NixOS module (or really anything else)
can place the TAs under that directory. Is there a benefit to building optee
client with the load path set within the nix build, but not as a builtin TA
(i.e. one of the early TAs)? It seems limiting to set the load path for runtime
TAs to a directory whose contents cannot be updated at runtime. With that said,
if /var/lib/optee is the load path, the optee client would require adding
CFG_TEE_CLIENT_LOAD_PATH to the build flags and the systemd service for
tee-supplicant would require adding the --ta-dir/-t flag. Does that sound
good?