Test: Protected VM fails if images are signed by unknown

Arrange:
- prepare VM images signed with a test key
Act:
- start a protected VM
Assert:
- a boot process fails due to pubkey mismatch between pvmfw and
  bootloader

Bug: 218934597
Test: atest MicrodroidHostTestCases
Change-Id: I05755ddf32839ef531ca9a11b2939bbc251ff1fb
diff --git a/tests/Android.bp b/tests/Android.bp
index 74d58f5..0062846 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -91,3 +91,11 @@
     ],
     type: "cpio",
 }
+
+genrule {
+    name: "test-payload-metadata",
+    tools: ["mk_payload"],
+    cmd: "$(location mk_payload) --metadata-only $(in) $(out)",
+    srcs: ["test-payload-metadata-config.json"],
+    out: ["test-payload-metadata.img"],
+}