Add TBYB safe rom_pick_ab_partition function

[will-v-pi]

This PR adds an extra wrapper around rom_pick_ab_partition, which makes it safer when called during a TBYB boot, and includes a call to get the flash_update_base

Currently, when doing a flash update boot which requires a flash erase, if you call pick_ab_partition before calling explicit_buy (eg to pick a firmware partition or similar) then it will clear always->zero_init.version_downgrade_erase_flash_addr. This means the subsequent explicit_buy call will not perform the required flash erase, which means the flash update boot will not succeed.

This adds saving and restoring the erase_flash_addr to prevent this happening, while still allowing the erase_flash_addr to be set if the firmware partition is being updated and requires a flash erase

This also adds setting up always->zero_init.tbyb_flag_flash_addr to allow for TBYB executables in the firmware partition to have the address set up correctly

The function returns an error if too many things are updating at once - either if both the boot and firmware images are TBYB, or if the boot and firmware images both require a flash erase

It also returns an error if the chosen image was not verified, which acts as a signature check on the firmware image