fit_image: Use calloc() to fix reproducibility issue

Vagrant Cascadian reported that mx6cuboxi target no longer builds
reproducibility on Debian.

One example of builds mismatches:

00096680: 696e 6700 736f 756e 642d 6461 6900 6465  ing.sound-dai.de
-00096690: 7465 6374 2d67 7069 6f73 0000            tect-gpios..
+00096690: 7465 6374 2d67 7069 6f73 0061            tect-gpios.a

This problem happens because all the buffers in fit_image.c are
allocated via malloc(), which does not zero out the allocated buffer.

Using calloc() fixes this unpredictable behaviour as it guarantees
that the allocated buffer are zero initialized.

Reported-by: Vagrant Cascadian <vagrant@reproducible-builds.org>
Suggested-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Fabio Estevam <festevam@gmail.com>
Tested-by: Vagrant Cascadian <vagrant@reproducible-builds.org>