UEFI boot entry manager

 nullboot installs kernel.efi binaries to the EFI system partition,
 registers them with the shim fallback loader and the UEFI boot order,
 and reseals the system for new kernel versions.