shim: verify Extended Key Usage flags
shim: verify Extended Key Usage flags

For starters; don't allow the "module signing" OID; which ought to
only ever be used for signing kernel modules, not signing EFI binaries.

Signed-off-by: Mathieu Trudel-Lapierre <bab670cc3de8a930dbcc4c98df4e7a8fdd9221c3@canonical.com>

rhinstaller/shim,rhinstaller/shim,rhinstaller/shim