Sign kernel, grub and shim Debian packages on OBS

Also build a Debian live image which will be live-secure-bootable - get the SSL cert via "GPG Key / SSL Certificate" button or via the command line and convert it from PEM to DER format:

wget https://build.opensuse.org/projects/home:bluca:debian_secure_boot/ssl_certificate -O- | openssl x509 -inform pem -outform der -out obs.der

and then add it to the UEFI DB list via the firmware (tianocore on QEMU) to test it.

There is also an ONIE.bin image that can be booted from the ONIE installer. It supports Secure Boot as well, as the kernel and modules are signed. The certificate from above needs to be added to the ONIE firmware.