SBAT Policy latest should be a one-shot
SBAT Policy latest should be a one-shot

Since booting from removable media can be hard to detect,
setting a persistent latest SBAT policy is risky in a typical
client system. This changes latest to be a one-shot operation
that could be set at the time of an OS update if desired.

Signed-off-by: Jan Setje-Eilers <2fa50e9a8424144a53c83562b5d43dc0f8a9d6e2@oracle.com>

rhinstaller/shim,rhinstaller/shim,rhinstaller/shim