Add support for signing kernel modules

Linux kernels which are built with CONFIG_MODULE_SIG support the
cryptographic signing of modules.  When in "permissive" mode
unsigned modules or signed modules with an unknown key will by
allowed to load but will mark the kernel as tainted.  When in
"restrictive" mode only modules signed with a known key will be
allowed to load.

This patch updates the build system so that it will automatically
sign modules if the required public and private keys are available.
These keys are generated as part of the kernel build process and
are named "signing_key.priv" and "signing_key.x509".  Placing a
copy of these keys in the ./modules/ directory will cause the
modules to be signed as part of the build process.  Alternately,
the SECKEY and PUBKEY variables may be set to specify a different
location.

make SECKEY=~/signing_key.priv PUBKEY=~/signing_key.x509

For additional information about signed kernel modules refer to
the documentation privided in the Linux kernel documentation.

https://www.kernel.org/doc/Documentation/module-signing.txt

Signed-off-by: Brian Behlendorf <behlendorf1@llnl.gov>