resign_firmwarefd.sh: support new "flag" (for hinting two-stop FW)

The two-stop firmware relies on the "flag" field which may be useful for the
resign_firmwarefd.sh.

BUG=chrome-os-partner:5095
TEST=./resign_firmwarefd [params] 1
     vbutil_firmware --verify ..... # seeing flag = 1

Change-Id: I56b44ee5b610e36384e15e6eb31286f0f838734b
Reviewed-on: http://gerrit.chromium.org/gerrit/4561
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Gaurav Shah <gauravsh@chromium.org>

scripts/image_signing/make_dev_firmware.sh

@@ -222,6 +222,7 @@ main() {
   debug_msg "Resign the firmware code (A/B) with new keys"
   local unsigned_image="$(make_temp_file)"
   cp -f "$IMAGE" "$unsigned_image"
+  # TODO(hungte) derive kernel key and preamble flag from existing firmware
   "$SCRIPT_BASE/resign_firmwarefd.sh" \
     "$unsigned_image" \
     "$IMAGE" \
@@ -231,6 +232,9 @@ main() {
     "$dev_firmware_keyblock" \
     "$kernel_sub_pubkey" >"$EXEC_LOG" 2>&1 ||
     err_die "Failed to re-sign firmware. (message: $(cat "$EXEC_LOG"))"
+    if is_debug_mode; then
+      cat "$EXEC_LOG"
+    fi
 
   # TODO(hungte) compare if the image really needs to be changed.