sign_official_build: Fix race on shared images in parallel signing

When signing with signer_config.csv, all rows are signed in parallel.
Each worker copied its AP and EC images from the shellball, and moved
the signed images back to the same paths. However, AP and EC images
are often shared by multiple rows. If a worker replaces an image while
another worker is copying it, cp fails with "skipping file ..., as it
was replaced while being copied", and the whole signing fails.

Fix the race by not modifying any image in the shellball while workers
are running. Instead, each worker leaves its signed images in its own
directory, and they are moved to the shellball in row order after all
workers finish.

This also makes the output deterministic. Previously, a worker might
start from an image already signed by another row, and a shared image
in the shellball was signed for whichever row finished last. Now every
worker signs the original image, and a shared image is always signed
for the last row, the same as signing serially. In addition, the
shellball images are left untouched if any worker fails.

BUG=b:532539923
TEST=Sign Nissa firmware updater (169 rows) with 16 jobs, with and
     without loem.ini; no failures, the output is identical across
     runs, and identical to signing serially before.
BRANCH=none
TAG=agy
CONV=705e5b3f-acf0-4ebd-91be-9a3d57b9198a

Change-Id: I50a8b55ab7815f3e394cdab8fdfdda0d6a6a6964
Signed-off-by: Yu-Ping Wu <yupingso@google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/8522502
Reviewed-by: Julius Werner <jwerner@chromium.org>
Tested-by: Yu-Ping Wu <yupingso@chromium.org>
Commit-Queue: Yu-Ping Wu <yupingso@chromium.org>