This epic will track work needed on the build side. We want to productize this:

https://github.com/containers/composefs-rs/blob/main/examples/unified-secureboot/build

Notes:

• Must use functionality in bootc (or higher level tools) and not require copying in a binary built on the host
• Obviously needs clear docs on production key usage
• Handle different bootloaders (MVP can be systemd-boot though)
• https://github.com/containers/composefs-rs/blob/main/examples/unified-secureboot/build must also align with https://docs.fedoraproject.org/en-US/bootc/building-from-scratch/
• Same with the Containerfile, ideally hide stuff like https://github.com/containers/composefs-rs/blob/126751dee8a71aa54c9666e69645d2fd1eccb176/examples/unified-secureboot/Containerfile#L44