implement streaming over-the-air A/B updates

[thestinger]

This is fairly straightforward to implement, but requires setting up more static files on the server. It will need a metadata-only update zip that's still properly signed along with a separate payload.

[thestinger]

The remaining work should be adding support for generating metadata-only update zips for both full and incremental updates, and then exposing a preference to enable streaming updates (disabled by default for now).

[thestinger]

The certificate authority whitelist in update_engine probably also needs to be changed.

[thestinger]

Not currently a priority due to it eliminating a layer of update security so it's unclear if we'd want to make it the default.