bootctl: Add a TKey for testing

Update the bootctl settings to use a TKey with sandbox.

Signed-off-by: Simon Glass <simon.glass@canonical.com>

include/bootctl.dtsi

@@ -31,6 +31,11 @@
 		measure;
 #endif
 
+		/* use TKey for unlocking encrypted volumes */
+#ifdef CONFIG_SANDBOX
+		tkey;
+#endif
+
 		/* restrict labels to boot (separated by space) */
 #ifdef CONFIG_QEMU
 		labels = "virtio";