add new finalize.py

This splits the finalization step from the bump.py script.

Now bump.py is only responsible for creating next year's FCM, kernel
configs, and updating the build files.

The new finalize.py script moves the latest FCM (the one being finalized)
unconditionally into SYSTEM_MATRIX_DEPS so all targets, regardless of
release configuration, will incude it in their builds.

Test: ./compatibility_matrices/finalize.py && m
Test: ./build/tools/build-step-0.sh
Bug: 388532499

Change-Id: Ic1c3bf1e82f54602aee514b541a927d4b02852d2
Merged-In: Ic1c3bf1e82f54602aee514b541a927d4b02852d2