Merge ~juliank/shim/+git/shim-signed:alternatives into ~ubuntu-core-dev/shim/+git/shim-signed:master

on_secure_boot and most of have_non_revoked_kernel are copied from grub-check-signatures (which would fail postinst with a debconf dialog, which is not actually meaningful as the files are unpacked and would be used). We should evaluate unifying things in the future, but this avoids both tying in a grub2 SRU (there is one in progress already) and our is-not-revoked helper can be used for build-time testing.

I need to actually copy in the bugs closed to the changelog but the implementation is ready for reviews now.

Regarding the design decisions, please see the ubuntu-devel thread. I think most of the complexity is in actually checking if we are good to install, so this is not a lot more complex than aborting in preinst but means it works fine if kernels and shim are upgraded in the same upgrade run, like setup_alternatives + hooking it into the kernel postinst.d is less code than putting up a debconf dialog with an error message :)

In a month or so, when we're sure everyone has upgraded their kernel we could remove the alternatives again and abort in preinst so that people can find out more easily that they're actually using shim 15.7 and not the old version.