KeyMint HAL: clarify time-based auth behaviour

Changes:
- correct the sign of the timestamp comparison text
- make updateAad() and finish() refer to the auth text in begin()
- describe auth flows for keys with AUTH_TIMEOUT on devices without
  a secure time source

Test: none, comment change only
Change-Id: Ia60a4a949e030a7a96772406e3b0f7b3211a0915