fs_mgr: allow no verity metadata when the device is unlocked.

To boot with generic system.img for project Treble, we should allow no verity
metadata when the device is unlocked. The previous fix checks system property
"ro.boot.flash.locked" but it's unavailable during first stage mount.
This CL checks "androidboot.verifiedbootstate" in kernel command line instead.

Bug: 63268209
Test: boot sailfish without metadata on /vendor

Change-Id: Ifd1dbeb2a2f09cd06903ecdd59bc94b3905a3fbd