Measure MRC cache into separate PCR

[osresearch]

The MRC cache is measured into the RAM stage PCR, which pollutes the otherwise deterministic value. It should go into its own PCR (which should be documented in issue #146 )

[osresearch]

This also requires two reboots to properly initialize the MRC and the TPM PCR; the PCR should be updated after the MRC is written to avoid this problem.

[tlaurion]

@geedo0 ?

[tlaurion]

#721 related and will probably be measured in same PCR following coreboot way of measuring firmware