Generate a vendor dbx file at build time

Generate a vendor dbx file at build time

This allow us to block executing binaries with specific
checksums. Generate the dbx list at runtime from a simple list of
sha256 hashes, so we can update this easily. If we need to also
blacklist a cert later, we'll need to update this code to add that
option too.

Add a build-dep on pesign to get the needed efisiglist program.