Sign systemd-boot EFI binaries under /usr

Sign systemd-boot EFI binaries under /usr

If secure boot signing is enabled with UEFI then `systemd-boot` binaries which
are at `/usr/lib/systemd/boot/efi` should be signed with the same signing key
that is used for EFI binaries within the ESP. In comparison to signed ESP
binaries, the '.signed' extension will be kept.

Without this change, any tool that copies these binaries into the ESP will
(likely) be copying an unsigned copy of `systemd-boot`. The service
`systemd-boot-update.service` is just one example of a service that will
regularly attempt to update `systemd-boot` within the ESP.