Defer unlock prompt until update is accepted

[crawfxrd]

Move unlocking from EC validation to the main app update logic. This allows users to accept updating before unlocking, or cancel without unlocking.

This does not resolve the issue of returning to firmware-update when canceling/failing the unlock prompt, as the boot override still exists.

The UX for this needs additional improvements.

TEST:

• [x] Can successfully flash on a firmware-open board with firmware locking
• [x] Can successfully flash on a firmware-open board without firmware locking
• [ ] Can successfully flash on a proprietary firmware board

Resolves: #81 Partially resolves: https://github.com/system76/firmware-open/issues/405

[XV-02]

I looked at:

• Oryp11 (locking firmware)
• Lemp11 (Non-locking firmware)
• Pang10 (Proprietary)

And all three worked as I believe is expected:

• Oryp11: Flash utility comes up, verifies the content, and presents the 'press enter to flash` prompt. Pressing enter prompts reboot and presents the lock. It unlocks, flashes, and does it's job.
• Lemp11: Flash utility comes up, verifies the content, and presents the 'press enter to flash` prompt. Pressing enter Causes it to flash and reboot.
• Pang10: Flash utility comes up, verifies the content, and presents the 'press enter to flash` prompt. Pressing enter Causes it to flash and reboot.

I also made sure to test a drive with the wrong firmware, which correctly errors out.

That sounds good?