Import chipsec tool and make it work in the recovery shell

[osresearch]

We should run chipsec as part of the recovery shell to ensure that the vulnerabilities disclosed in the REcon MTL presentation are not present in the Heads firmware. coreboot mailinglist discussion: https://mail.coreboot.org/pipermail/coreboot/2017-July/084766.html

https://github.com/chipsec/chipsec/tree/master/chipsec

[osresearch]

Issue #184 relates to this, since it is about configuring the PRR and FLOCKDN before launching the user processes.

[osresearch]

chipsec needs python, so it might not fit in the normal ROM image. The kernel module will, and perhaps it will be useful.

[osresearch]

The module assumes CONFIG_EFI is enabled. We don't have any EFI vars nor runtime services, so it might not work.