Add enterprise policy to control TPM firmware update settings.

This adds a device policy that allows admins to remotely configure
availability of TPM firmware update functionality.

BUG=chromium:762030
TEST=Manual: Powerwash should be triggerable for enrolled devices that have a TPM firmware update pending.

Change-Id: I2ba74b406aefa273799281cc2876d5d624c18679
Reviewed-on: https://chromium-review.googlesource.com/678504
Commit-Queue: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Igor <igorcov@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Bartosz Fabianowski <bartfab@chromium.org>
Reviewed-by: Xiyuan Xia <xiyuan@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#504099}
Cr-Mirrored-From: https://chromium.googlesource.com/chromium/src
Cr-Mirrored-Commit: de865bafb9b1d80a4bc4361d6a194e0ddf7de649