package_to_container: create a signed app

In addition to updating package_to_container and the generated
config.json files (includes changes from CL:417097), output the
manifest and sign it.

The layout is:
  manifest.json - file w/config.json & rootfs hashes
  manifest.json.sig - signature of manifest.json

By default we use the devkey from vboot.

BUG=chromium:660209
TEST=run_oci only runs containers with a valid manifest.json{,.sig}
CQ-DEPEND=CL:427498

Change-Id: I3f570ade96e267b420a4609919ebc3af3c7cdc5b
Reviewed-on: https://chromium-review.googlesource.com/415231
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
3 files changed