MGS driven SP components left in invalid state should have a way to recover from failed updates

Specifically in the case of the RoT, it could be left in an un-updateable state. In the case of there being a bad signature check on the alternate RoT image, either the pending-persistent or just the persistent boot preference will need to be set to the good image before proceeding.

We could add a variant to UpdateAttemptStatus called RestoringComponent (or similar) and have apply_update set the status to this new status if the component needs to be set to a different state before an update. This could happen after a precheck.

Needs https://github.com/oxidecomputer/hubris/pull/2050 to fully work

To be able to differentiate whether an RoT has a mismatch with the active version and persistent boot preference or transient/pending boot preference are not empty due to a failed update or an ongoing update we'll need https://github.com/oxidecomputer/hubris/issues/2066 which will be available soon.

Start by reading the UpdateAttemptStatus type and the apply_update and precheck paths described in the issue. Review hubris#2050 and issue#2066 to understand the required component and boot-preference behavior. Done should provide a recovery state for components needing restoration and allow failed or ongoing RoT updates to be distinguished from a normal preference mismatch.