Add SecureBoot support via prebootloader

Tested only under QEMU using OVMF SecureBoot enabled firmware plus lockdown-ms. Both loader.efi
(gummiboot) and vmlinuz.efi should be hashed before boot in secure mode.