Add support for creating self-decrypting binaries

[will-v-pi]

This adds extra functionality to the pico_encrypt_binary function to allow creating self-decrypting binaries, including specifying the OTP page to use for the AES key.

pico_encrypt_binary(hello_encrypted
    ${CMAKE_CURRENT_LIST_DIR}/privateaes.bin
    ${CMAKE_CURRENT_LIST_DIR}/ivsalt.bin
    EMBED
    OTP_KEY_PAGE 29)

The main non-backwards-compatible change is the addition of a new IV salt bin file which is required and must be passed as the second argument. This will break any uses of pico_encrypt_binary, and has been added for security purposes, as we now salt the public IV with a salt stored in OTP.

The other non-backwards-compatible change it that if you previously called:

pico_encrypt_binary(my_target my_aesfile.bin my_sigfile.pem)

you now need to call

pico_encrypt_binary(my_target my_aesfile.bin my_iv_salt.bin SIGFILE my_sigfile.pem)

due to the new argument parsing. I think that this is fine, because the only time you'd pass a separated SIGFILE to pico_encrypt_binary is when you're using a different signing key for the binary vs the encrypted blob, which is not a common use case.

This PR requires use of the picotool encrypted-shares branch (raspberrypi/picotool#207), so should be merged after that.