Check for Secure Boot setting during install process

[zenmonkeykstop]

Description

Currently having Secure Boot enabled breaks the install process on first reboot after the grsec kernel is in place. While this is covered in docs, and we could look at signing kernels as per freedomofpress/kernel-builder#47 , there will probably be a lot of fresh installs happening in the immediate future, and checking early (using mokutil or similar) in the install playbook would catch this and prevent admin confusion and delay.

User Research Evidence

Anecdotal feedback from support and forums.

User Stories

As an admin, I want to be alerted to misconfigurations or incompatible BIOS settings early and in a transparent manner, rather than trying to debug opaque failures.