This allows the migration from one key provider to another.
Note that secret_id values must remain unique across all keymasters
in a given pipeline. If they are not unique, the right-most keymaster
will take precedence.
When looking for the active root secret, only the right-most keymaster
is used.
Change-Id: I6b5c812a54624f56c55164556385e3e475fb2470