Load arm with SB enabled.

Make sure we actually try to validate secure boot on this platform (even
though we're not shipping it enabled by default.)

This means giving the kernel grub's loaded image as the vehicle for the
kernel command line, because we can't call systab->bs->LoadImage() if SB
is enabled.
Try $prefix if $fw_path doesn't work.

Related: rhbz#1148652

Signed-off-by: Peter Jones <pjones@redhat.com>