Restrict the verification in block-based incremental OTAs

BlockImageDiff has three versions. Only the incremental OTAs generated
with the latest version (3) can be re-applied to the system that's
already on the target build. Otherwise, operations like move will make
unconditional changes and damage the system. During the verification
phase, abort the OTA update if BlockImageDiff is less than 3 and it
doesn't match the checksum of the source build.

Change-Id: I3a776495b69e1d174fcb01b10e40c0e912914fd8