inject/vendor.sh: stricter set + usage

set - as soon as possible, for example in the extract_me
function.

we only turn off error handling when certain error-prone
tasks are performed, and mitigations are in place after
these commands run to make sure that the result was valid.

this is because in some cases, we want certain buggy behaviours
to be permitted, with errors handled in a more fine-tuned way,
because sh can sometimes be much stricter depending on the
implementation; otherwise, we almost always rely on -e -u in
most of the build system.

this mainly affects the vendorfile insertion logic.

Signed-off-by: Leah Rowe <leah@libreboot.org>

include/inject.sh

@@ -19,7 +19,6 @@ inject()
 {
 	remkdir "$tmpromdel"
 
-	set +u +e
 	[ $# -lt 1 ] && err "No options specified"
 	eval "`setvars "" nuke new_mac xchanged`"
 

include/vendor.sh

@@ -160,6 +160,7 @@ extract_intel_me()
 	x_ rm -Rf "$xbmkpwd/metmp"
 
 	( fx_ find_me x_ find "$xbmkpwd/$appdir" -type f ) || :; :
+	set -u -e
 
 	if [ "$ME11bootguard" = "y" ]; then
 		apply_deguard_hack