Enforce 10s timeout on Bootz HMAC challenge

[gh4683]

Enforce 10s timeout on Bootz HMAC challenge

[gemini-code-assist]

Code Review

This pull request introduces a 10-second timeout mechanism for TPM 2.0 HMAC challenges in both the BootstrapStream and BootstrapStreamV1 endpoints. It integrates the clockwork library to allow mockable time tracking during testing and adds a timeout test case for the V1 stream. The review feedback suggests optimizing the timeout checks by storing the elapsed duration in a local variable instead of calculating it twice, and recommends adding a corresponding timeout test case for the V0.6 BootstrapStream endpoint to ensure consistent test coverage.

[Chounoki]

I assume you use a 3rd party library instead of the built-in time package only for the test override capability.

Although I guess that can also be achieved by simply sleeping 11 seconds in the test code with the built-in time package to get the same test result.