Build a monolithic kernel

At https://github.com/freedomofpress/kernel-builder/pull/45#issuecomment-2029144010 @thedeadliestcatch wrote:

I would strongly suggest considering building monolithic kernels with a minimal config. If you transition away from HVM to pvgrub, and even if you don't, it will be a good idea. Removing LKM support has several benefits in terms of reducing attack surface in the kernel for ROP and code injection scenarios (after all, LKM support comes with the implicit need for a dynamic linker in kernel space).

I replied:

This is a good point and something I started wondering about mid-last week, whether there was any benefit to building individual modules. I'll look into doing a monolithic build.

From what I can tell we just need to change all the m settings to y and then turn off CONFIG_MODULES. We should make sure that the blacklisted modules (see https://github.com/freedomofpress/securedrop/issues/1886) are disabled at build-time as well.

Read the kernel configuration changes described in this issue and the referenced SecureDrop issue #1886 first; no file or test is named. Done means the build uses built-in settings instead of modules, disables CONFIG_MODULES, and disables the blacklisted modules at build time.