[zircon][gn] Omit firmware blobs when CIPD didn't download them

Follow the existing behavior of omitting the files from the image
when scripts/download-prebuilt sets internal_access=false.

Bug: BLD-325
Test: manual build with no CIPD auth
Change-Id: Ib776a97b8873f26074998ebc2705c57bf190f991
diff --git a/zircon/.gitignore b/zircon/.gitignore
index ad6780d..f7db35f 100644
--- a/zircon/.gitignore
+++ b/zircon/.gitignore
@@ -25,6 +25,7 @@
 /infra/.recipe_deps
 /out*
 /prebuilt/downloads/
+/prebuilt/config.gni
 /prebuilt/config.mk
 /prebuilt/config.mk.bak
 /AnalysisResult/
diff --git a/zircon/public/gn/firmware.gni b/zircon/public/gn/firmware.gni
index 4d18762..d356c5b 100644
--- a/zircon/public/gn/firmware.gni
+++ b/zircon/public/gn/firmware.gni
@@ -2,6 +2,7 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
+import("$zx/prebuilt/config.gni")
 import("resource.gni")
 
 # This is the directory populated by $zx/scripts/download-prebuilt.
@@ -23,6 +24,7 @@
 # omitted, it defaults to `[ "{{source_file_part}}" ]` so the string matches
 # the string in `sources` after any slash.
 #
+# This is a no-op when the firmware downloads are not available at build time.
 template("firmware") {
   resource(target_name) {
     forward_variables_from(invoker, "*", [ "outputs" ])
@@ -38,5 +40,9 @@
         "lib/firmware/{{source_file_part}}",
       ]
     }
+
+    if (!have_firmware) {
+      sources = []
+    }
   }
 }
diff --git a/zircon/scripts/download-prebuilt b/zircon/scripts/download-prebuilt
index 410b79e..0080910 100755
--- a/zircon/scripts/download-prebuilt
+++ b/zircon/scripts/download-prebuilt
@@ -279,8 +279,13 @@
   fi
 }
 
-write_config_mk() {
+write_config() {
   local -r internal_access="$1"
+  local -r config_gni="${PREBUILTS_DIR}/config.gni"
+  rm -f -- "$config_gni"
+  echo > "$config_gni" "# Generated by $0.  DO NOT EDIT!
+have_firmware = $internal_access"
+
   local -r config_mk="${PREBUILTS_DIR}/config.mk"
   rm -f -- "$config_mk"
   echo > "$config_mk" "# Generated by $0.  DO NOT EDIT!"'
@@ -315,7 +320,7 @@
     # We don't have CIPD, so don't use it.
     for_each_package download_package < "$VERSIONS_FILE" || return
   fi
-  write_config_mk "$internal_access"
+  write_config "$internal_access"
 }
 
 verify() {