Ensure update_verifier run before zygote

Currently zygote is started early for FBE device but update_verifier is run later
which creates a potential risk. This CL ensures update_verifier run before
zygote touches anything within data/ partition. With this change, we also start zygote
early for unencrypted/unsupported encryption state device.

Bug: 37543411
Test: marlin boots
Change-Id: I95daa73bc1a503eecb70d7be78251b74b773abf8