sign_official_cos_build: Support signature-based IMA

Previously, the script only supported hash-based IMA. This commit
replaces the "ima" option with "ima_hash" and "ima_sign" options. To
maintain backwards compatibility, "ima" is an aliase for "ima_hash".
The "ima_sign" option requires an ima_key.pem in the key dir.

BUG=b/465211305
TEST=presubmit
RELEASE_NOTE=None

Change-Id: I61440922cd1689534fc01c46145e2d080a64c1db
Reviewed-on: https://cos-review.googlesource.com/c/third_party/platform/vboot_reference/+/153404
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>