Support MOK blacklist

The new blacklist, MokListX, stores the keys and hashes that are
banned.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: show the hash list properly

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: delete the hash properly

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: Match all hashes in the list

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
MokManager: Write the hash list properly

also return to the previous entry in the list

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Copy the MOK blacklist to a RT variable

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
No newline for console_notify

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Verify the EFI images with MOK blacklist

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>
Exclude ca.crt while signing EFI images

If ca.crt was added into the certificate database, ca.crt would be the first
certificate in the signature. Because shim couldn't verify ca.crt with the
embedded shim.cer, it failed to load MokManager.efi.signed and
fallback.efi.signed.

Signed-off-by: Gary Ching-Pang Lin <glin@suse.com>