[util/design] How to get raw (unhashed) transition_token for LC transition ?

### Description

Hi,

I'm running simulation for LC state transiton.
I used `util/design/otp-img-gen.py` to generate vmem with hjson files `hw/top_earlgray/data/otp/otp_ctrl_img_dev.hjson` (I modify lock from "False" to "True").
```
{
name: "SECRET2",
lock: "True",
items: [
{
name: "RMA_TOKEN",
value: "",
}
{
name: "CREATOR_ROOT_KEY_SHARE0",
value: "",
}
{
name: "CREATOR_ROOT_KEY_SHARE1",
value: "",
}
],
}
```

`util/design/otp-img-gen.py` generated `OTP.vmem` and integrated scrambled RMA_TOKEN successfully.

When I run LC transition simulition, my understanding is that I need to set TRANSITION_TOKEN0~3 registers.
Then the raw `TRANSITION_TOKEN` will be calculated by cSHAKE128, generates a hashed token and compare with hashed `RMA_TOKEN` in OTP.vmem.

So my question is how to get the raw TRANSITION_TOKEN0~3 ?

In addition, if the `RMA_TOKEN` need to be programed into OTP at CP or DEV stage, how to calculate the hashed RMA_TOKEN from it's corresponding raw TRANSITION_TOKEN ?

Thanks!

Start with util/design/otp-img-gen.py and the referenced hw/top_earlgray/data/otp/otp_ctrl_img_dev.hjson to understand how RMA_TOKEN is generated and placed in OTP.vmem. Then trace the LC transition simulation's TRANSITION_TOKEN0~3 registers, cSHAKE128 processing, and comparison with RMA_TOKEN. Done should document how to obtain the raw transition token and calculate the corresponding hashed RMA_TOKEN for CP or DEV programming.

Written by the indexing model from the issue text.