plat-qcom: hoya: lemans: wire up fuse PTA and QFPROM for PAS authentication

Signature authentication reads fuses at runtime, so CFG_QCOM_PAS_AUTH
alone is not enough: the fuse PTA and the qfprom driver behind it must
come up with it too.

Fold the existing fuse-provisioning enable into the same block so it and
the new fuse-PTA consumer share one QFPROM enable and cannot drift
apart.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Assisted-by: Claude:sonnet-5
Reviewed-by: Sachin Grover <sgrover@qti.qualcomm.com>

Author: zelvam95

core/arch/arm/plat-qcom/hoya/lemans/target.mk

@@ -7,10 +7,6 @@ ifneq ($(CFG_INSECURE),y)
 CFG_QCOM_QFPROM_FUSEPROV ?= y
 endif
 
-ifeq ($(CFG_QCOM_QFPROM_FUSEPROV),y)
-$(call force,CFG_QCOM_QFPROM,y)
-endif
-
 CFG_QCOM_PAS_PTA ?= y
 
 ifeq ($(CFG_QCOM_PAS_PTA),y)
@@ -20,7 +16,18 @@ ifeq ($(CFG_QCOM_PAS_PTA),y)
 CFG_RESERVED_VASPACE_SIZE ?= (256 * 1024 * 1024)
 CFG_IN_TREE_EARLY_TAS += qcom_pas/cff7d191-7ca0-4784-af13-48223b9a4fbe
 CFG_QCOM_PAS_AUTH ?= y
-CFG_PAS_MD_SLOTS = 8
 endif
 
 CFG_QCOM_HWKM ?= y
+
+ifeq ($(CFG_QCOM_PAS_AUTH),y)
+$(call force,CFG_QCOM_FUSE_PTA,y)
+CFG_PAS_MD_SLOTS = 8
+# This chip's OEM_CONFIG2 fuse row has a per-root-cert hash function
+# select bit; targets without it always use SHA-384.
+$(call force,CFG_QCOM_SEGMENT_HASH_SELECT,y)
+endif
+
+ifneq ($(filter y,$(CFG_QCOM_QFPROM_FUSEPROV) $(CFG_QCOM_FUSE_PTA)),)
+$(call force,CFG_QCOM_QFPROM,y)
+endif