Triple call CFI Counter reset when seeding the prng

[andreslagarcavilla]

From Nick Galloway (gallowayn@google.com)

Affter RomEnv has been created, cfi_counter::CfiCounter::reset() is called to seed the prng for the CfiCounter. That function is marked with #[inline(never)], but it should instead be always inlined and called multiple times (say, three) so that it's harder to glitch past the prng seed from the trng. To successfully exploit this would require the ability to successfully glitch past the current non-inlined prng seed and then also a second time to glitch past something else (say FMC signing checks). After the initial prng seed all of the delays would be deterministic because the initial state of the Xoshiro128 prng is itself deterministic, so this should be straightforward for someone able to glitch twice on a single run.