installer/functions: verifykernelsig, verify kernels signature.

Use dev_debug_vboot to figure out if dev_boot_signed_only should
be re-enabled.
test/tests/19-verifykernel: Test if kernel signature check is working.

The test should succeed on all autotest platforms, as they run
official images.
installer/main.sh: Check kernel verification before setting dev_boot_signed_only=1.

Since the test can take up to ~15 seconds to run, we run it in background,
and only update the flag after the prepare script has run.

We also move USB/legacy boot warnings to the end of the script.