[Update Workflow] Phase 3: Standard iPXE/secureboot symlink setup

[darksidemilk]

Summary

Part of a 6-phase roadmap (see #1005 for Phase 1 and the full roadmap list).
Automates convenience symlinks an admin currently has to create by hand: a
web-reachable copy of the netboot iPXE EFI binary, and Secure Boot
shim/snponly binaries placed next to the published MOK.der, for local/USB
boot when PXE netboot isn't an option.

Design

Grounded in the current code:

• _publishSecureBootKit() (lib/common/functions.sh ~line 4640) already
  publishes MOK.der to $webdirdest/service/secureboot/ when
  $secureBootCert is set.
• configureTFTPandPXE() (~line 1141) stages the built/downloaded iPXE
  binaries -- including the Secure Boot shim/snponly set from
  downloadipxesecureboot() -- under $tftpdirdst (typically /tftpboot),
  including a $tftpdirdst/secureboot/ subdirectory.
• linkIfAbsent() (~line 34) is the existing safe-symlink helper (never
  clobbers a path something else owns, cleans up dangling links from a prior
  version, safe to re-run) -- reuse it rather than a bare ln -s.

New function, e.g. linkConvenienceEFI(), called after configureTFTPandPXE
and after _publishSecureBootKit in the main install flow:

• Web-root convenience symlink: the netboot-ready root-level iPXE EFI binary
  FOG already stages at $tftpdirdst -> a path under $docroot, so a
  technician can browse to it directly for local/USB boot.
• Secure Boot shim/snponly convenience symlinks: each staged
  $tftpdirdst/secureboot/*-shimx64.efi / snponly.efi / arm64 variant ->
  $webdirdest/service/secureboot/ (the same directory MOK.der already
  lives in) -- only created when _publishSecureBootKit actually ran (i.e.
  Secure Boot is configured and the files exist).
• All links via linkIfAbsent(), idempotent across repeated
  install/update runs (including via Phase 1's updatefog.sh).

Explicit scope note: the "10-second delay" iPXE variant some admins
maintain personally is a custom-built binary FOG does not produce today (no
such build target in fog-ipxe/buildipxe.sh). This plan does not add a
delay-variant build or its symlink -- that would be a distinct fog-ipxe
feature request. Called out here so it isn't silently dropped from the
original ask.

Files touched

• lib/common/functions.sh (new linkConvenienceEFI() + call site near
  configureTFTPandPXE/_publishSecureBootKit)

Verification

• Fresh install with a Secure Boot key/cert configured: confirm the web-root
  iPXE EFI symlink resolves and boots via browser-download/USB, and
  $webdirdest/service/secureboot/ contains symlinks to the shim/snponly
  binaries alongside MOK.der.
• Fresh install without Secure Boot configured: confirm no broken/dangling
  symlinks are created.
• Re-run installfog.sh/updatefog.sh and confirm no duplicate-link errors
  or drift.