Improve how the dbx hashes are handled

Improve how the dbx hashes are handled

Only include the hashes for the architecture we're building for - no
point in adding bloat and delay here.

Add a script "block_signed_deb" to scan a set of .deb files, extract
the hashes for .efi binaries and list them in the format wanted for
the dbx hashes file.

Split out the code to use that file from the rules file into a
separate helper.