Replace product variable stashing with .KATI_READONLY

Instead of using rot13 / rot26, use the Kati extension to mark these
variables as readonly.

Move $(strip) for a few variables to before they're marked readonly. Use
a different variable for modifications to BOARD_KERNEL_CMDLINE in
build/core/Makefile.

Test: build/tools/kati_all_products.mk on AOSP and internal master
Test: build-aosp_bullhead.ninja the same before / after
Change-Id: If98b24af763831a9c5c2de38037a69ab1bf9e023
diff --git a/core/main.mk b/core/main.mk
index de77927..dabe093 100644
--- a/core/main.mk
+++ b/core/main.mk
@@ -504,12 +504,9 @@
 
 FULL_BUILD := true
 
-# Before we go and include all of the module makefiles, stash away
-# the PRODUCT_* values so that later we can verify they are not modified.
-stash_product_vars:=true
-ifeq ($(stash_product_vars),true)
-  $(call stash-product-vars, __STASHED)
-endif
+# Before we go and include all of the module makefiles, mark the PRODUCT_*
+# values readonly so that they won't be modified.
+$(call readonly-product-vars)
 
 ifneq ($(ONE_SHOT_MAKEFILE),)
 # We've probably been invoked by the "mm" shell function
@@ -574,10 +571,6 @@
 # Now with all Android.mks loaded we can do post cleaning steps.
 include $(BUILD_SYSTEM)/post_clean.mk
 
-ifeq ($(stash_product_vars),true)
-  $(call assert-product-vars, __STASHED)
-endif
-
 # -------------------------------------------------------------------
 # All module makefiles have been included at this point.
 # -------------------------------------------------------------------