Support non-EFI devices

Currently secboot only supports EFI-based secure boot. But, there are other implementations, for instance, signed u-boot with signed FIT image. I wonder if it's possible to decouple EFI from secboot to support such devices.

I haven't yet read all the related codes, and just have some initial thoughts about the implementation/modification:
* how to verify secure boot is enabled for non-EFI systems
* allow to skip the check of secure boot (maybe depend on the grade?)
* implement other policy/stub profile generation for different boot-loader

Any thoughts?