provider: fix key selection bug with OSSL_STORE_load

If a program follows the standard recommendation for OSSL_STORE_Load()
and doesn't include an OSSL_STORE_expect() limitation, then the
selection passed to decoders has the value 0.  For the tpm2 provider,
this causes on the public key to be selected (even if the loader is
looking for the private one) because the
OSSL_KEYMGMT_SELECT_PRIVATE_KEY bit isn't set.  Fix this by adding a
check for selection being zero.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>