Clarify PIN protected managements keys and PIN derived management keys

[ericchiang]

https://developers.yubico.com/yubikey-piv-manager/PIN_and_Management_Key.html

[FiloSottile]

I had a look at what yubikey-manager does for protected management keys, and it looks like piv-go has the protected metadata part down, but it doesn't set the right flag in the unprotected metadata, so ykman doesn't know to use the stored key.

https://github.com/Yubico/yubikey-manager/blob/7fb59f633ea1a782d401ff3f03b1f0a859f5fb16/ykman/piv.py#L164

I'll see if I can send a PR to expand the Metadata type and methods.