GM: use GM safety model even if passive

[vntarasov]

Symptom:
On some GM cars, in stock, openpilot will start-stop recording arbitrarily during the drive.

Problem:
"car started" on GM uses CAN-based ignition hook, and on cars where battery voltage drops below openpilot's threshold (e.g. when engine turns off on a full stop), drive recording stops. Main two cases are 1) chffrplus, and 2) openpilot forced to passive mode because stock LKA / ACC modules are online.

Proposal:
Instead of tweaking battery voltage threshold (doesn't fix the problem for soft hybrids), always use GM's CAN-based ignition logic on GM cars, even in chffrplus / passive openpilot.

Pros:

• Setting safety model to noOutput is redundant, since controlsd sets sendcan to None if passive.
• If either LKA or ACC commands are being sent by stock modules, GM safety model in Panda goes to full silence, not even chimes or radar configuration will be sent.

Cons:

• GM safety model in Panda doesn't know if openpilot is running in passive mode, and, for example, will still set controls_allowed to 1, if driver presses "set" / "reset". On GM cars without LKA/ACC features, or with those modules disconnected, chffrplus would drive on sending-ready panda.

Let me know if you guys can think of a better solution, or if GM safety model needs a special "passive" mode, for example, entered by passing a special CarParams.safetyParam.

[rbiasini]

... or if GM safety model needs a special "passive" mode, for example, entered by passing a special CarParams.safetyParam.

I think a better solution would be to define a "gm passive safety model" in panda, where fwd hook is no_output, but the ignition hook remains the gm one (the same thing should be done for other cars as well). For safety reasons, I would prefer passive==1 to put panda in a state where any message sending is disallowed.

[vntarasov]

Will add gm_passive safety model.