Make sure endorsement cert matches current keyladder.
Make sure endorsement cert matches current keyladder.

Endorsement registration is done with 0 for FWR keyladder branch.
The certificate packet has hmac with key derived from keyladder.
Thus RW can check that the certificate packet it is about to load does
indeed match its current keyladder status. If not, reject.

BUG=none
BRANCH=none
TEST=launch RW that has 1 for FWR and observe fail; 0 for FWR RW succeeds.
Change-Id: I820892a54fbf9aa52a6f778595b5b7ef4389cff3
Reviewed-on: https://chromium-review.googlesource.com/393233
Reviewed-by: Vadim Bendebury <5515d6d2d0829cbe0dd0dcf2094aaded06d58514@chromium.org>
Reviewed-by: Marius Schilder <d423f2980be0298efdef7df239b147d21d472f26@chromium.org>
Tested-by: Vadim Bendebury <5515d6d2d0829cbe0dd0dcf2094aaded06d58514@chromium.org>
Tested-by: Marius Schilder <d423f2980be0298efdef7df239b147d21d472f26@chromium.org>
Commit-Queue: Marius Schilder <d423f2980be0298efdef7df239b147d21d472f26@chromium.org>

coreboot/chrome-ec,coreboot/chrome-ec,coreboot/chrome-ec,coreboot/chrome-ec,coreboot/chrome-ec,coreboot/chrome-ec