stub: restore compatibility for shim (< 16.0) -> UKI case

stub: restore compatibility for shim (< 16.0) -> UKI case

It is possible to boot directly a UKI from shim, and Fedora Cloud Base UKI
does exactly this.
This used to work fine until https://github.com/systemd/systemd/pull/37372
which broke compatibility when shim < 16.0 (no loader protocol override) is
used. Shim 15.8 is still in use in several distributions, and will be for
a long time.

Restore a part of the previous implementation, and if running with secure
boot enabled, and with shim but < 16.0, apply a security override.

Follow-up for cab9c7b5a42effa8a45611fc6b8556138c869b5f

Fixes https://github.com/systemd/systemd/issues/38104