add support for Secure Boot

[bcressey]

What I'd like:
On platforms where Secure Boot is supported, I'd like strong cryptographic verification of all components from the bootloader to the running kernel.

Any alternatives you've considered:
None.

[bcressey]

This has been in-flight for a while on a branch in my personal fork but is now nearing the point where the full picture is visible and pieces can start to be merged. There's also some work related to #2486 since I'd like to support the resigning workflow described there as a prerequisite.

Tasks related to resigning images:

• Refactor image and symlink handling, to simplify bundling up artifacts from the image build step.
• Move OVA creation into the image build step.
• Implement import-images and export-images tasks to store and retrieve artifacts from the repo.
• Implement resign-images task.

Tasks related to Secure Boot:

• Update GRUB to fix Boothole 3 vulnerabilities.
• Package shim for initial bootloader verification.
• Add SBAT info for GRUB.
• Add scripts to create necessary keys and certificates for Secure Boot signing.
• Add modules to GRUB to enable signed config files.
• Add feature flag to enable Secure Boot for variants.
• Sign bootloader, kernel, GRUB config when Secure Boot is enabled.
• Publish AMIs and OVAs with required Secure Boot metadata.

[bcressey]

I dropped the task related to a separate firmware build step, since @markusboehme has a patch that allows embedding the GPG public key into a section in the grub binary, which allows for "just in time" key modification without the need to rebuild grub from source.

[markusboehme]

I dropped the task related to a separate firmware build step, since @markusboehme has a patch that allows embedding the GPG public key into a section in the grub binary, which allows for "just in time" key modification without the need to rebuild grub from source.

For the record, these patches are available at https://github.com/markusboehme/bottlerocket/tree/feature/grub-pubkey-section

[bcressey]

@yeazelm is working on the image resigning tasks in #2486 and bottlerocket-os/twoliter#176.

[bcressey]

Resolving now that #3097 is merged! 🎉