holderKeyAgreement

Make holder keys able to agree keys too (PURPOSE_AGREE_KEY), for deviceMac in person (WalletConfiguration.ProximityDeviceAuth.MAC_PREFERRED). It needs API 31; below it, or where the hardware refuses a key for both, holder keys sign only, and the wallet signs. StrongBox comes first: a holder key StrongBox can't make for both is made there to sign, never moved to the TEE to agree keys. A holder key that also requires the holder (holderUserAuthentication) signs too: the holder is authenticated for a signature, not an agreement.