✨ Enable secureboot for all flavors (minus alpine)

[Itxaka]

This PR brings new deps, bumps builders and agent to bring secureboot in all flavors but alpine (more ont hat below)

Currently to enable secureboot in a given X flavor we need to make sure to use the artifacts from that falvor specifically as they are all signed with the distro owner key, so the chain of validation works as expected.

shim (dual signed Microsoft and distro owner) -> grub (distro owner signed) -> kernel (distro owner signed)

So unless there comes a time where the shim is signed by Microsoft and ALL the distro owners (so you can chainload all grubs and kernel signed by all of them) we need to specifically use the distro artifacts so the signatures match.

This PR brings a new enki version(inside osbuilder) which builds the iso using the specifci distro artifacts (instead of generic ones as we used to do).

It also makes sure that all distros include the grub and shim signed artifacts in the base images.

Also brings a new framework that drops the generic grub artifacts (not used) and it also brings a new agent that uses those new artifacts during installation instead of the generic ones.

Unfortunately Alpine does not provide signed artifacts so SecureBoot is not supported under Alpine until they provide those. We still use our generic artifacts to enable uefi support for Alpine

What this PR does / why we need it:

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #

[Itxaka]

leap 15.5:

• boots with secureboot
• installs with secureboot
• no regexp module in the grub directly so cmdline is NOT correct. we need to ship the module during install and insmod it

Fedora 38:

• boots with secureboot
• installs with secureboot
• regexp modules is bundled in grub

[Itxaka]

Debian bookworm:

• boots with secureboot
• installs with secureboot
• regexp bundled with grub

Ubuntu 23.10(probably the rest):

• NOT boot with secureboot(incorrect naming, grub is stored as grubx64.efi but its looking for grub.efi)
  

[Itxaka]

looks like on ubuntu is failing to find the actual shim and using the fallback so that is why it cant find the proper named thingie. So it may be a package missing

                +iso | INFO[2024-01-12T08:51:42Z] Creating EFI image...                        
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/usr/share/efi/x86_64/shim.efi: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/usr/lib/shim/shimx64.efi.signed: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/boot/efi/EFI/fedora/shim.efi: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/boot/efi/EFI/rocky/shim.efi: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/boot/efi/EFI/redhat/shim.efi: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] skip copying /tmp/enki-iso683099797/rootfs/boot/efi/EFI/almalinux/shim.efi: not found 
                +iso | DEBU[2024-01-12T08:51:42Z] Using fallback shim file /efi/EFI/BOOT/bootx64.efi 

[Itxaka]

yeah and the root problem is:

• shimx64.signed is a link to the alternatives as you can have newer shims lrwxrwxrwx 1 root root 36 Apr 16 2020 shimx64.efi.signed -> /etc/alternatives/shimx64.efi.signed
• in our rootfs alternatives is not installed so you get an empty link
• testing in a normal image properly links the file

So the solution is to try and pick the shimx64.efi.signed.latest file instead or even better, they have a dualsigned one shimx64.efi.dualsigned signed by them AND microsoft, so thats even better.

[Itxaka]

Using fix kairos-io/enki#25 resutls in proper isos with secureboot for all distros (minus alpine)
Installs correctly for all distros
leap/opensuse still missing the regexp module bundled, will need to check further

[Itxaka]

with that merged and pacakge bumped, the only missing fix is for agent:

• On ubuntu install copy the grub.cfg under /EFI/ubungu/grub.cfg
• On opensuse install, copy the regexp module for grub (check the proper paths where its copied)

The default grub config already does an insmod regexp so either is not being copied properly or its missing from the sources or its just on a wrong path.

[Itxaka]

kairos-io/kairos-agent#203 fixes ubuntu boot.

[mauromorales]

nice!

[Itxaka]

latest fixes should fix:

• ubuntu grub copy Add workaround for secureboot ubuntu flavor kairos-agent#203
• opensuse regexp modules missing Drop regex module from bootargs packages#619

[Itxaka]

both fixes deployed via framework 2.6.3, needs manual QA