build-sys: enable tpm by default

It's been on in Fedora for ages, and it seems strange to have
a feature that's off by default.