check PLATFORM_SECURITY_PATCH value in product Makefile

On devices that no longer receive vendor updates (e.g. Pixel 4 / 4 XL), PLATFORM_SECURITY_PATCH
should be overriden to correctly indicate that.

config/device/common/gen4pixel.yml

@@ -8,6 +8,7 @@ includes:
 device:
   build_id: TP1A.221005.002.B2
   prev_build_id: TP1A.221005.002
+  platform_security_patch_level_override: 2022-11-01
 
 filters:
   files:

src/build/make.ts

@@ -246,6 +246,13 @@ PRODUCT_MANUFACTURER := ${mk.manufacturer}`)
 endif`)
   }
 
+  let splOverride = config?.device?.platform_security_patch_level_override
+  if (splOverride !== undefined) {
+    blocks.push(`ifneq ($(PLATFORM_SECURITY_PATCH),${splOverride})
+  $(error PLATFORM_SECURITY_PATCH: expected ${splOverride}, got $(PLATFORM_SECURITY_PATCH))
+endif`)
+  }
+
   return finishBlocks(blocks)
 }
 

src/config/device.ts

@@ -29,6 +29,8 @@ export interface DeviceConfig {
     system_fs_type: FsType
     build_id: string
     prev_build_id: string
+    // ignored when undefined
+    platform_security_patch_level_override?: string
   }
 
   platform: {