Include shim's vendor_cert in MokListRT

There needs to be some way to communicate to the kernel that it's a
trusted key, and since this mechanism already exists, it's by far the
easiest.
MokManager needs to disable the graphics console.

Without this patch, on some machines we never see MokManager's UI.  This
protocol has never (I think?) been officially published, and yet I still
have new hardware that needs it.

If you're looking for a reference, look at:

EdkCompatibilityPkg/Foundation/Protocol/ConsoleControl/ConsoleControl.c

in the edk2 tree from Tiano.

Signed-off-by: Peter Jones <pjones@redhat.com>
Don't replace UEFI services in insecure mode.

Signed-off-by: Peter Jones <pjones@redhat.com>
Also hook systab->BS->Exit() so we can e.g. exit back to BDS safely.

Signed-off-by: Peter Jones <pjones@redhat.com>
Make verbose stuff use console_notify

Signed-off-by: Peter Jones <pjones@redhat.com>