g12: Guard prebuilt tee*/keymaster for devices with no OP-TEE

g12: Guard prebuilt tee*/keymaster for devices with no OP-TEE

* These need to be split out because development
  boards don't have OP-TEE, and even if they could
  kang another device's, we have no functional keys
  or TA files, so it's useless and broken.

* Devices that have no OP-TEE need to set
  `TARGET_HAS_TEE := false` in their lineage_${DEVICE}.mk.

* So that we can successfully encrypt as per the fstab
  entry for `/data`,  build the AOSP keymaster 4.1 service,
  and that uses a VINTF fragment.

Change-Id: I8756ba2d9cd5c53725645185783f9e15b739602c