Add support for installing shim

Add support for installing shim

Unfortunately shim is a necessary evil that we have to support. We
add a new option that allows choosing either a signed version, an
unsigned version or none at all (the default).

We also stop redirecting /boot/efi to /efi so that /efi is our pristine
directory for populating the ESP whereas /boot is unclaimed wasteland
free for package managers to write all kinds of stuff to.