Store firmware binaries in CAS

[AlCutter]

This PR updates the Makefile and cloudbuild configs to store the applet firmware binary in the correct CAS location.

See transparency-dev/armored-witness-common#15

[mhutchinson]

Approval modulo the cloudbuild changes because I can only give a coin-flip answer to whether this would work.

[mhutchinson]

I'd like @jiggoha to take a look at this entrypoint swapping business.

[jiggoha]

I think the reason Al has added that here is so that the sha256sum and other bash commands work correctly. The environment variables here get populated correctly not because of bash environment variables, but because of Cloud Build substitution vars. So without the entrypoint, we can't do any logic here. Is that right, Al?

[AlCutter]

Yup, that's right

Need to add a comment about copying the manifest

[jiggoha]

Following our video call just now, I think we can/should delete the ### Copy the signed manifest to the public artifacts bucket. step here. We can directly copy the local file to the log for it to be sequenced.

(Commenting on the file because I can't seem to figure out how to comment on a single line of code if it's not been modified in a PR?)

[AlCutter]

Approval modulo the cloudbuild changes because I can only give a coin-flip answer to whether this would work.

Me too :)

I wonder if there's way we could have a "dry-run" on PRs for at least the CI GCB config where it doesn't actually store/modify anything?