use prebuilt for the shim

The testing shim should be included as a prebuilt. This allows
us to destroy the signing key. This means that the shim can never
be upgraded in the field; aside from its intended purpose in
a CTS test.

Bug: 28398205
Change-Id: I033835d227416ff8aa6602abfc8b977c74cb666d