bacon: Relocate disk encryption metadata

 * Due to an issue outside our control, we cannot put the crypto
   metadata in the userdata footer.
 * Move it to reserve4 and enable migration code.

Change-Id: I71b5d570e7022865b769239cb93528350de288fa