move secure boot setup to imghelper

Description of changes:

Moves code-blocks related to secure boot to imghelper, with some minor adjustments for portability.

Testing done:

• Built and smoke tested aws-k8s-1.28

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

• Removed assumption that the caller will change directory to ${EFI_MOUNT}/EFI/BOOT before calling UEFI helpers.
• Removed circular references.

• Split uefi_pesign into several more targeted functions.
• Renamed some things for consistency and clarity.

Rebased.

• Moved SHIM_SIGN_KEY and CODE_SIGN_KEY declaration to imghelper.
• Wrapped profile setup under a single sbsetup_signing_profile function.
• Moved setup a few lines down to share the UEFI_SECURE_BOOT conditional.