Throw exception if SP cannot be unwrapped during migration

Ignoring failures here leaves the device unusable, due to leaving the CE
key not encrypted by the SP.  Therefore, throw an exception to cause the
upgrade to fail.

Bug: 376481713
Flag: EXEMPT bugfix
Test: build
Change-Id: I7235994c712cc9fe79eccb5f32679bee435bd63d