Add the actual implementation changes for the new metadata field for

recoverable key

The metadata, if given, will be authenticated (but unencrypted) together
with the key material when the key is uploaded to cloud.

Bug: 112191661
Test: atest FrameworksCoreTests:android.security.keystore.recovery
      atest FrameworksServicesTests:com.android.server.locksettings.recoverablekeystore
      atest -m RecoveryControllerHostTest RecoverableKeyStoreEndtoEndHostTest RecoverySessionHostTest

Change-Id: Ib62557d5ebd2bd7d206c04cf73c1dabb65882e49