[mask rom] Describe Mask ROM Interface Structures
[mask rom] Describe Mask ROM Interface Structures

This PR describes the two main Mask ROM structures, which are also used
as interfaces with other parts of the Secure Boot process.

These structures are the Boot Policy structure, and the ROM_EXT manifest
structure.

This change settles some open questions:
- How do we protect the Boot Policy structure: We'll use a checksum.
- Can the Boot Policy choose different actions upon failing to parse a
  ROM_EXT manifest vs upon failing to authenticate the signature? No,
  the boot policy chooses the same action in both eventualities. These
  actions are coarse: either try the next ROM_EXT, or fail to boot. What
  these actions require the code to do may change depending on which
  step failed.
- How do we end up versioning the ROM_EXT manifest: The versioning only
  changes how the BL0 area is parsed, the rest of the manifest has to
  be static as it is accessed by the Mask ROM (which cannot be updated).
  The BL0 area is still signed, but the OT Mask ROM makes no
  requirements on what information it includes. The ROM_EXT manifest
  version is outside the BL0 area as it is one of the software binding
  properties.

This change introduces two new Open Questions:
- Do we allow ROM_EXT manifests to choose their own entry point, or is
  the entry-point a hard-coded offset within the image?
- Do we allow ROM_EXT manifests to set their own PMP region extents, or
  are these extents hard-coded too?

Signed-off-by: Sam Elliott <32a4841301e2f444934d6e427a2764482fa7a43d@lowrisc.org>

lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan,lowRISC/opentitan