Prepare to support UKIs

[arnaldo2792]

Description of changes:

This series prepares the kernel kit to support Unified Kernel Images.

The first commit in the series prevents grub from being used with a variant that opt-in to use the new UKI format, and makes it provide the %{_cross_os}bootloader(efi) capability.

The second commit in the series prepares an extra copy of the shim that looks for systemd-boot instead of GRUB, and re-structures the spec to resolve either subpackage depending on the features enabled for the variant.

The remaining commits in the series drop a patch to don't measure PCR9 in the kernel. systemd-boot triggering PCR9 measurements in the kernel, but this patch prevented the kernel from actually updating the PCR. The side-effect is that in GRUB-based AMIs, PCR9 measurements will be as follows:

• in x86_64, no changes, as the kernel lacks the support to measure PCR9 with GRUB
• in aarch64, two PCR9 measurements: the kernel measures the cmdline once and user space measures again, with the updated parameters provided by bootconfig.

Testing done:

• As part of Prepare to support UKIs bottlerocket-core-kit#1007: I booted Bottlerocket variants with UKIs. Confirmed that PCR9 measures the kernel command line at the kernel level for both arches.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[jmt-lab]

[P2] MokManager is copied only from build-grub but shipped in the base package

%install copies mm*.efi exclusively out of the build-grub tree, and the resulting file is packaged in the base %files list (line 104), which is installed alongside both subpackages.

Concerns:

1. Asymmetric build coupling. MokManager doesn't depend on DEFAULT_LOADER, so both build trees produce it. Sourcing it only from build-grub couples the base package to that specific build. If a follow-up PR conditionally disables the grub build for UKI-only variants (e.g., wraps lines 77, 80-81 in %if !%{uki_only}), the base %files list still references %{efidir}/%{mokm_efi_image} and the build breaks non-obviously.
2. find … -exec cp doesn't signal 'no match'. find returns 0 whether or not it matched. If the grub build silently stops producing mm*.efi in the future, the failure surfaces later at %files ("File not found") rather than at the copy step.

Suggested fix: either copy mm*.efi from build-systemd-boot (identical bits, decoupled from the grub build) or add a brief comment stating that MokManager is loader-independent and either build tree is acceptable, e.g.:

# MokManager is not affected by DEFAULT_LOADER; either build tree is fine.
find %{_builddir}/build-grub -name '%{mokm_efi_image}' -exec \
  cp {} "%{buildroot}%{efidir}/%{mokm_efi_image}" \;

Confidence: ~60%.