Fix Secure Boot support

- Debian's GRUB is patched with no_insmod_on_sb.patch, which does not
  really work in combination with our modularized GRUB. Quick&dirty
  unpatch it (by changing the names of the variables in the binary)
- Shim requires DER-encoded binary certificates, not Base64 ones.
- Use skipsign.efi to hook LoadImage calls in loaded binaries to allow
  unsigned binaries to be loaded from GRUB.

- Optionally (and by default) switch from Shim to the Linux Foundation's
  PreLoader, as the user experience is nicer.