Ensure kernel_lockdown is enabled and active

[q3k]

man 7 kernel_lockdown

This is tangentially related to enabling Secure Boot, but we should do it as early as possible - even if we don't sign things and have module loading disabled.

[msgctl]

It looks like this feature is already enabled in an appropriate way:

fd16651a third_party/linux/linux-smalltown.config    (Lorenz Brun    2020-04-01 17:29:45 +0200 3503) CONFIG_SECURITY_LOCKDOWN_LSM=y
fd16651a third_party/linux/linux-smalltown.config    (Lorenz Brun    2020-04-01 17:29:45 +0200 3504) # CONFIG_SECURITY_LOCKDOWN_LSM_EARLY is not set
fd16651a third_party/linux/linux-smalltown.config    (Lorenz Brun    2020-04-01 17:29:45 +0200 3532) CONFIG_LSM="lockdown,yama,loadpin,safesetid,integrity"```

[fionera]

Since we need module loading now, we have to also implement module signing