[FEATURE] Signed external kernel modules rejected on Fedora CachyOS kernel despite DB key being trusted

### Pre-flight checklist

- [x] I have searched existing issues/PRs and this has not been requested before.
- [x] I have read the [Contributing Guidelines](https://github.com/CachyOS/linux-cachyos/blob/master/CONTRIBUTING.md).

### Request type

- [ ] New patch / patchset inclusion
- [x] Kernel config change (enable/disable option)
- [ ] New kernel variant
- [ ] Scheduler tuning / addition
- [ ] Compiler / LTO / PGO optimization
- [ ] Security hardening
- [ ] Driver or hardware enablement
- [ ] Other

### Summary

Signed external kernel modules are rejected by the Fedora CachyOS kernel, while the same modules work with the stock Fedora kernel.

The module is signed with a key enrolled in UEFI DB, but the CachyOS kernel reports:

```
modprobe: ERROR: could not insert 'nvidia': Key was rejected by service
```

and dmesg shows:

```
Loading of module with unavailable key is rejected
```

### Motivation / use case

I use Secure Boot with externally built kernel modules (for example, NVIDIA driver modules).

The same signed module loads successfully with Fedora's stock kernel, but fails with the CachyOS kernel. This prevents using Secure Boot together with out-of-tree modules.

### Patch / upstream reference (if available)

Related discussion:

- CachyOS PR/Issue: Enable kernel configuration parameters for Secure Boot module signing (#46)

The kernel configuration contains the Secure Boot related options from that change, including:

```
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y
CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT=y
```

However, platform keys still do not appear to be usable for module signature verification.

Possible missing configuration or patch differences compared with Fedora kernel may involve:

```
CONFIG_INTEGRITY_CA_MACHINE_KEYRING
CONFIG_IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
```

or other Fedora-specific changes related to trusted keyring handling.

### Testing / benchmarks

Environment:

- Fedora 44
- kernel-cachyos 7.1.3-cachyos1.fc44.x86_64
- Secure Boot enabled
- Key source: UEFI DB (not MOK)

Module signature:

```

modinfo nvidia

signer: Database Key
sig_hashalgo: sha512

```

Key status:

```

keyctl list %:.platform

asymmetric: Database Key

```

The key is present in the platform keyring.

However:

```

keyctl search %:.secondary_trusted_keys asymmetric "Database Key"

keyctl_search: Required key not available

```

The same signed NVIDIA module works with Fedora's official kernel.

### Additional context

Relevant CachyOS kernel configuration:

```

CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_ALL=y
CONFIG_MODULE_SIG_HASH="sha512"

CONFIG_INTEGRITY=y
CONFIG_INTEGRITY_SIGNATURE=y
CONFIG_INTEGRITY_ASYMMETRIC_KEYS=y
CONFIG_INTEGRITY_TRUSTED_KEYRING=y
CONFIG_INTEGRITY_PLATFORM_KEYRING=y
CONFIG_INTEGRITY_MACHINE_KEYRING=y

CONFIG_SYSTEM_TRUSTED_KEYRING=y
CONFIG_SECONDARY_TRUSTED_KEYRING=y

```

Could you please check whether the CachyOS Fedora kernel requires additional configuration or patches to allow UEFI DB keys to be used for external module signature verification?