Prevent SPL downgrade OTAs from generating

Previously we allow all spl downgrade OTA to generate. But applying such
OTA often causes device to hang and rollback, because keymaster refuses
to attach if it detects spl downgrade. When such error happens, it's
really hard to debug. So instead of debugging a mysterious boot failure,
let''s prevent such OTA from generating in the first place.

Test: th
Bug: 178584781

Change-Id: I8e271862d804e86b16aea70424b4d3e289d43cc9