UKI: Verify images signature before upgrade

[mudler]

Is your feature request related to a problem? Please describe.

When we do an upgrade, it's a blind-action. That is to say that we pull the image nevertheless of the content and we lay the content inside the EFI directories

Describe the solution you'd like

Before laying the content down, would be preferred to check the integrity of the UKI files, so we know that we install something that at least doesn't break measurement and will get into a booting system afterwards (if there aren't errors on the image itself). This would save us from pulling EFI files signed by other entities or not-compatible keys.

Describe alternatives you've considered

Additional context

[mudler]

as @nianyush pointed out, maybe https://github.com/Foxboron/sbctl/blob/master/cmd/sbctl/verify.go#L62 sbctl verify <filename> could do the trick (still untested)