Use vbmeta digest to detect same-version upgrades

When using Custota in conjunction with avbroot, there may be situations
where a new patched OTA has the same version as the currently running
OS. The most common example is updating Magisk.

With this commit, if the OTA's fingerprint matches the current OS
fingerprint, Custota will compare the vbmeta digest to determine if an
update is necessary. This should reliably detect every scenario where
the OTA's version is the same, but the partition contents differ.

The vbmeta digest is not readily accessible in an OTA, so custota-tool
will compute it when generating the csig file. This is an unfortunately
an expensive operation that requires extracting partitions from the OTA,
so it will slow down custota-tool a decent bit.

Because Custota's csig file parser is strict, the file format version
has been bumped to version 2. csig files generated by a new version of
custota-tool are incompatible with old versions of Custota. However, new
versions of Custota can continue to read old version 1 csig files. It
will fall back to the old behavior when encountering an old csig file.

Fixes: #38

Signed-off-by: Andrew Gunnerson <[email protected]>