Non-Volatile Vars handling: more common sense requirements

[andreiw]

As a continuation of #82:

• Require` authenticated variables to only be modifiable in-band (via the RT interface), no direct access from OS to hardware (EDIT: this is already in SEC_020 requirement in https://github.com/riscv-non-isa/riscv-server-platform/blob/main/server_platform_requirements.adoc)
• Require recovery from a corrupt or empty variable store.

These could be predicated on secure boot, hypothetically.

[andreiw]

" no direct access from OS to hardware" seems out of scope... better to be in server-platform spec... in fact this is the SEC_020 requirement.