trusted-firmware-m: Add initial plumbing for TFM

This commits adds a config option to build a PSA trusted-firmware-m
(TF-M) application image for the secure processing environment, and
configures the Zephyr application image for the non-secure processing
environment. The secure and non-secure environment images will be
linked together via the veneer function table that is produced as an
artifact of the TF-M build process.

Signed-off-by: Karl Zhang <karl.zhang@linaro.org>