recovery: require wp disabled for v1 flagfile

For version 1 decryption recovery flagfile, now require that the device
have firmware write protect disabled. For version 2, write protect
disabled OR authenticated system owner is needed for dumping encrypted
stateful partition.

Reworked build to always link against libvboot_host for the crossystem
library calls.

BUG=chromium:236093
TEST=link build, manual verification and unittests

Change-Id: I9401fad5224ac9b28dcf9998d69c6c6ce1d672e3
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-on: https://gerrit.chromium.org/gerrit/57667
Reviewed-by: Elly Jones <ellyjones@chromium.org>
Reviewed-by: Will Drewry <wad@chromium.org>