arm: mps_an521_nonsecure: Add TFM BL2 support

PSA level 1 requires secure boot. TF-M BL2 is the official
secure boot loader. It needs a BL2_HEADER_SIZE offset.

Align nonsecure address with TF-M's NS slot while TF-M BL2 enabled.

Signed-off-by: Karl Zhang <karl.zhang@linaro.org>