[rom_ext] Inactive ROM_EXT is being locked down via flashcontroller

[jettr]

Description

With ROM 7.0.7, it appears that ROM_EXT is locking down the inactive ROM_EXT region instead of the active ROM_EXT via the flash controller.

$ opentitantool rescue get-boot-log
...
  "rom_ext_slot": "SlotA",
  "rom_ext_major": 0,
  "rom_ext_minor": 7,
  "rom_ext_size": 65536,
  "rom_ext_nonce": 0,
  "bl0_slot": "Unknown",
  "ownership_state": "LockedOwner",
...

Dump from owner firmware (which agrees that active ROM_EXT is SlotA):

> version
version
RO_A:  * 7.0.7/00000000
RO_B:    7.0.7/00000000
RW_A:    0.36.4/DBG/ti50_common_tot:v0.0.1623-249835b2
RW_B:  * 0.36.4/DBG/ti50_common_tot:v0.0.1623-249835b2
> md 0x41000050 20
md 0x41000050 20
0x41000050: 09666666 09669966 09666666 09669966
0x41000060: 06696666 06696666 09669966 06696666
0x41000070: 00004000 00004100 00019c20 00019d20
0x41000080: 000024ee 000023ee 000003ff 00001dee
0x41000090: 00966666 00000000 00000000 00000000

Notice that region[1] is 0x00004100 (which is page 256 to 288, i.e. SlotB ROM_EXT) has permission 0x09669966, which means that program and erase are denied. However, region[0], which corresponds to SlotA ROM_EXT, has permission 0x09666666, which is fully writable.