net: align the EPSLOCI dummy with the corrected trace study (v2.7.2)

The UICC_NAA.md C3/C3a recipes were re-checked against the corpus: the
EPSLOCI dummy tail is FF*13 + `FF FE` + status - the TAC is always FFFE
(never FF) and the status byte is 01 (not updated), not FF; the old
`<FF*16>` reading was a misparse of that tail.  The rejection form
(status 02) is the C3a spec model: the only observed rejection trace never
writes 6FE3 at all.

- build_epsloci_dummy(status=ST_NOT_UPDATED, keep_plmn=None): corrected
  tail; keep_plmn selects the NMR style that preserves the last visited
  TAI PLMN (the guest style wipes GUTI and TAI PLMN) - both are observed
- write_dummy_locations(): drop the all-FF special case (service loss now
  ends `FF FE 01`) and thread keep_plmn through
- tests: exact guest/NMR/rejection vectors, 18-byte length, runner
  assertions for service_lost and roaming_denied; netstate fixture updated
- UICC_NAA.md C3a tail `<FF*15> 02` corrected to `<FF*13> FF FE 02`;
  the PWA help/param text no longer claims the EPSLOCI dummy keeps the
  PLMN; SW cache simple-v205

tests/test_netstate.py

@@ -61,7 +61,8 @@ class NetworkTests(unittest.TestCase):
             loci=file_entry('EF.LOCI', '6F7E', 'FFFFFFFF62F2106CD7FF01'),
             psloci=file_entry('EF.PSLOCI', '6F73',
                               'FFFFFFFFFFFFFF62F2106CD7CA01'),
-            epsloci=file_entry('EF.EPSLOCI', '6FE3', '0BF6' + 'FF' * 16))
+            epsloci=file_entry('EF.EPSLOCI', '6FE3',
+                               '0BF6' + 'FF' * 13 + 'FFFE' + '01'))
         loc = netstate._current_location(st['files'])
         # wiped EPSLOCI -> RAI from PSLOCI
         self.assertEqual(loc['plmn'], '26201')