Rework QemuFirmware=

Rework QemuFirmware=

- Use the qemu official firmware descriptions to look up OVMF
  firmware instead of having our own homegrown logic.
- Add QemuFirmware=uefi-secure-boot to explicitly look for firmware
  with secure boot support
- Add QemuFirmwareVariables=microsoft to use OVMF variables with
  Microsoft keys enrolled
- Add QemuFirmwareVariables=custom to enroll the certificate from
  SecureBootCertificate= into the OVMF variables

This commit also contains the changes from a second commit that
was accidentally rebased into this one:

Only use already signed binaries when ShimBootloader=signed

When we're using signed shim, we need to make sure we use already
signed bootloaders, kernel images and UKIs. Anything we sign ourselves
will cause security violations in shim.