Add an optional metadata blob for recoverable application keys

This metadata, if present, will be authenticated (but unencrypted)
together with the application key material.

Bug: 112191661
Test: atest FrameworksCoreTests:android.security.keystore.recovery
      atest FrameworksServicesTests:com.android.server.locksettings.recoverablekeystore
      atest -m RecoveryControllerHostTest RecoverableKeyStoreEndtoEndHostTest RecoverySessionHostTest

Change-Id: I2846952758a2c1a7b1f0849e1adda1f05a3e305e