Fix comment in docs about ID attestation.

ID attestation will not work if the device identifiers are altered in
the system image. This is because KeyMint checks the device identifiers
that are provided in a generateKey call against the device identifiers
that were provisioned in the factory. If there is a mismatch, the key
request is rejected. The documentation on getSerial() has been fixed to
clarify this.

Test: The new documentation is semantically digestible by a SWE
Change-Id: Ie300cd167bb82b44e38fb3e091b90abe02a7c197