feat(spoof): include vbmeta.device_state

Live install on the user's Pixel surfaced a fourth bootloader-lock
prop the source plan never enumerated. The Chunqiu-style detector
card listed three indicators on its bootloader-unlock row and
flagged red because ro.boot.vbmeta.device_state remained unlocked
even after ro.boot.verifiedbootstate, ro.boot.flash.locked, and
ro.boot.veritymode were all spoofed.

Add ro.boot.vbmeta.device_state=locked to BootStateManager.targets.
Verified post-reboot on device: all four props now report the
spoofed values.

app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt

@@ -10,6 +10,7 @@ object BootStateManager {
             "ro.boot.verifiedbootstate" to "green",
             "ro.boot.flash.locked" to "1",
             "ro.boot.veritymode" to "enforcing",
+            "ro.boot.vbmeta.device_state" to "locked",
         )
 
     fun apply() {