Ensure update_verifier run before zygote

Currently zygote is started early for FBE device but update_verifier is run later
which creates a potential risk. This CL ensures update_verifier run before
zygote touches anything within data/ partition. With this change, we also start zygote
early for unencrypted/unsupported encryption state device.

Bug: 37543411
Test: marlin boots

(cherry picked from commit 5dc05eff)

Change-Id: I97cde0c20f74b1b17c995d84c2e31c86fe006395