Support non-EFI devices

[tsunghanliu]

Currently secboot only supports EFI-based secure boot. But, there are other implementations, for instance, signed u-boot with signed FIT image. I wonder if it's possible to decouple EFI from secboot to support such devices.

I haven't yet read all the related codes, and just have some initial thoughts about the implementation/modification:

• how to verify secure boot is enabled for non-EFI systems
• allow to skip the check of secure boot (maybe depend on the grade?)
• implement other policy/stub profile generation for different boot-loader

Any thoughts?