MA-18680-2 Support derive rpmb key from BKEK

MA-18680-2 Support derive rpmb key from BKEK

The BKEK will bind to the soc chip and we don't need to
store the encapsulated keyslot after using BKEK as the
rpmb key, which reduces the risk of losing the rpmb key.

This commit adds two commands to support derive the rpmb
key from BKEK and erase the rpmb storage (for debug purpose,
need support from trusty):
  $ fastboot oem set-rpmb-hardware-key
  $ fastboot oem erase-rpmb

Legacy keyslot way is still supported and boards programed
with keyslot can still work in compatible way. Command
to set provisioned rpmb key is changed to:
  $ fastboot stage <rpmb-key>
  $ fastboot oem set-rpmb-staged-key

Test: Key set and boot on imx8mn/imx8qxp.

Change-Id: Ifc88010fe8802d3550e42dff0bbd5a5e5ad922a3
Signed-off-by: Ji Luo <ji.luo@nxp.com>
(cherry picked from commit 0fd1b5e41645ac3f5c05ad82258df1645c59fb5a)
(cherry picked from commit 6a5125b9caf4c2e036853d8f53f8398c147758b3)