build: sign modules and set trust anchor/lockdown

build: sign modules and set trust anchor/lockdown

this is required for secure boot support.

at build time, an ephemeral key pair will be generated and all built modules
will be signed with it. the private key is discarded, and the public key
embedded in the kernel image for signature validation at module load time.

this change means that every kernel release must be considered an ABI change
from now on, else the signatures of on-disk modules and the signing key
embedded in the running kernel image might not match.

Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>