Stage 1 mounts securityfs, so require that in the kernel
gummiboot-builder.py: Not rewriting entries probably doesn't save much time, and is problematic in the case where you delete the latest generation before your rebuild