Build system: Changes to drive cert_create for dualroot CoT

The build system needs to drive the cert_create tool in a slightly
different manner when using the dualroot chain of trust.

 - It needs to pass it the platform root of trust key file.

 - It must not try to generate the Non-Trusted Firmware Key Certificate,
   which is not part of the dualroot CoT.

Change-Id: Ibcc821c5735765523730f861ae8230208f41302b
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>