Merge "Add OEM config for enhanced confirmation mode and add restricted read ops" into tm-dev