Add Microsoft's 2023 CAs to db in User Mode

[mastacontrola]

Closes #182.

Problem

A Windows image carrying the boot manager signed by Windows UEFI CA 2023 fails Secure Boot on a target whose db holds only the 2011 Microsoft CAs (forums topic 18246).

Change

• sbMsDbUpdate applies Microsoft's KEK-signed db updates (DBUpdate2024.bin, DBUpdate3P2023.bin, DBUpdateOROM2023.bin) with attribute 0x67 (append).
• Each 2023 CA is added only where its 2011 counterpart is already in db. KEK must hold Microsoft Corporation KEK CA 2011, or the task warns and continues.
• db is re-read after each write. A write the firmware did not apply fails the task.
• fog.enrollsb runs this in User Mode, before the "already trusted" exit. Setup Mode is unchanged, because sbEnrollDb already writes the 2023 CAs.
• The Microsoft files ship in /usr/share/fog/secureboot/, byte-identical to microsoft/secureboot_objects and to the server's mscerts.
• ADR-0019 records the decision.

Verification

• tests/checks/secureboot.sh: 64 passed. Cases 41–50 are new and use the shipped Microsoft files. Four mutations (replace instead of append, no re-read, no KEK check, no 2011 prerequisite) each turn cases red.
• OVMF, QEMU q35 with SMM, Secure Boot enforcing, factory-like 2011 key set: all three CAs added, 2011 CAs kept, tampered payload refused, 0x27 write refused, change persists across reboot.

Not verified: the fog.enrollsb entry point end to end on a FOG server, and any physical firmware.

🤖 Generated with Claude Code