efi: Import certificates from UEFI Secure Boot

efi: Import certificates from UEFI Secure Boot

Secure Boot stores a list of allowed certificates in the 'db' variable.
This patch imports those certificates into the platform keyring. The shim
UEFI bootloader has a similar certificate list stored in the 'MokListRT'
variable. We import those as well.

Secure Boot also maintains a list of disallowed certificates in the 'dbx'
variable. We load those certificates into the system blacklist keyring
and forbid any kernel signed with those from loading.

[[email protected]: dropped Josh's original patch description]
Signed-off-by: Josh Boyer <[email protected]>
Signed-off-by: David Howells <[email protected]>
Signed-off-by: Nayna Jain <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>