Support signing certificate for default holder config.

The package name and an optional signing certificate is separated by a
colon (`:`).

Fixes: 190703786
Test: Manual
Test: Clean flash with a default holder config set to a correct
      certificate and ensure role is granted.
Test: Clean flash with a default holder config set to an incorrect
      certificate and ensure role isn't granted.
Change-Id: I5ab6950a5bdc0fd62c5e49c238c422b4579e55dc