T861: minor improvements to secure-boot certificate handling

[c-po]

Change summary

Place secure-boot certificates outside of chroot environment and just "copy them" into it.
Kernel will work from Git repos root directory to locate certs instead of a relative path.
Kernel will be signed by vyos-dev-2025-linux.key

Image build will fail if a private key is found on the live CD for secure-boot

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T861

Related PR(s)

• T861: add UEFI Secure Boot support #763
• Kernel: T861: enable lockdown subsystem as UEFI secure boot dependency #875
• T861: update secure-boot certificate handline example vyos-documentation#1609

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.