ukify: add --pcrsig and --join-pcrsig arguments to append offline signature

ukify: add --pcrsig and --join-pcrsig arguments to append offline signature

Add a build parameter to take an existing UKI and attach a .pcrsig section
to it. This allows one to create a UKI with a .pcrpkey section with
--policy-digest to get the json output from sd-measure, sign the digest
offline, and attach the .pcrsig section with the signature later.