soc/intel/cnl: lock AES-NI feature if selected