Fix the orphan snakeoil/OVMF_VARS.snakeoil.fd file

`snakeoil/OVMF_VARS.snakeoil.fd` might not match `OVMF_CODE.secboot.fd` we use in tests.

Here are some ways we could handle it:
* Use `lockdown.efi` from efitools to install snakeoil keys on any `OVMF_VARS.fd`
* Put the snakeoil keys as well as code and variables images for OVMF in a separate repo.

Start by comparing snakeoil/OVMF_VARS.snakeoil.fd with the OVMF_CODE.secboot.fd used in tests, then review the two proposed approaches involving lockdown.efi and a separate OVMF image repository. Done means the orphan image is either made consistent with the test code image or its ownership and replacement path are clearly established.

Written by the indexing model from the issue text.