Support bloom firmware bundle signature verification
Adds support to Bloom installer to verify firmware bundle signatures as
described in go/bloom-fw-bundle-signing.
Invocation in gBMC firmware in go/gbmccl/253676.
Tested:
* Install gBMC w/ installer support manually (`devtool modify gbmc` + use local copybara to update sources)
* Download latest bundle from GAR: https://pantheon.corp.google.com/artifacts/generic/tpu-software/us-central1/ironwood-firmware
* scp to TPU-CC machine
* Run `/tmp/bundle_update --target_address="${BMC_IP}:3995" --file /tmp/ironwood-host%3A2025.11.27.1%3Aironwood-host.tar.gz update`
* From BMC, run `journalctl -u install-service.service. Output:
```
...
Nov 13 02:27:11 localhost verify_bundle.sh[30732]: /usr/share/google-bundle-key/ironwood_bundle_bringup.pem
Nov 13 02:27:11 localhost verify_bundle.sh[30732]: Try verify /usr/share/google-bundle-key/ironwood_bundle_bringup.pem
Nov 13 02:27:19 localhost verify_bundle.sh[30732]: Signature verification succeeded with key: /usr/share/google-bundle-key/ironwood_bundle_bringup.pem
...
```
PiperOrigin-RevId: 842758923
Change-Id: I292ffb87b17b574e7152e4183a9a0106c72b7f8a
1 file changed
