cmd/tailscaled: only warn about unsupported attestation when enabled (#20028)

We don't need to log if the policy doesn't actually say that hardware
attestation must be enabled.

Updates #cleanup

Signed-off-by: Andrew Lytvynov <awly@tailscale.com>

cmd/tailscaled/tailscaled.go

@@ -923,7 +923,9 @@ func handleTPMFlags() {
 	case !args.hardwareAttestation.set:
 		policyHWAttestation, _ := policyclient.Get().GetBoolean(pkey.HardwareAttestation, false)
 		if err := canUseHardwareAttestation(); err != nil {
-			log.Printf("[unexpected] policy requires hardware attestation, but device does not support it: %v", err)
+			if policyHWAttestation {
+				log.Printf("[unexpected] policy requires hardware attestation, but device does not support it: %v", err)
+			}
 			args.hardwareAttestation.v = false
 		} else {
 			args.hardwareAttestation.v = policyHWAttestation