On high security devices, ROM enables firewalls to protect the OCSRAM
region access during bootup. Only after TIFS has started (and had
time to disable the OCSRAM firewall region) will we have write access to
the region.
This means we will need to move the stack & heap from OCSRAM to HSM RAM
and reduce the size of BSS and the SPL to allow it to fit properly.
To protect us from overflowing our ~256k of HSM SRAM, add limits and
check during the wakeup SPL build.