DICE mode validation for KeyMint in a VM

Unlocked devices should have at least one non-normal mode on the DICE
chain for KeyMint (default) instance when KeyMint is inside a VM.

Test: atest VtsHalRemotelyProvisionedComponentTargetTest
Bug: 389955086
Change-Id: I691f7e6d405a86686aaad56a679efcf842a814c2