Enable signed boot verification if usb/legacy boot are disabled.

Otherwise, suggest to run a command but don't actually do it.
All of these boot options are opt-in, so if the others are set, the user
probably doesn't want crouton to be setting dev_boot_signed_only behind their
back.