MdeModulePkg/SecurityStubDxe: Defer 3rd party image before EndOfDxe

MdeModulePkg/SecurityStubDxe: Defer 3rd party image before EndOfDxe

The images not from FV are treated as 3rd party images. They will
be deferred to dispatch when they are dispatched before EndOfDxe
event.
It's a new feature in the BS.LoadImage() path which can disallow
executing 3rd party images before EndOfDxe and re-execute them
after EndOfDxe (through EfiBootManagerDispatchDeferredImages
introduced in next commit).

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Chao B Zhang <chao.b.zhang@intel.com>
Reviewed-by: Sunny Wang <sunnywang@hpe.com>