Secure Boot certificate updates

[gibmat]

Bit of a random grab bag of Secure Boot certificate related updates:

• Properly calculate offset when parsing .auth files. This should allow us to properly handle a variety of supported signature types rather than our previously hard coded assumption of RSA+SHA256.
• Update test certificate generation to more closely match production certificates
• Update docs to better reflect our Secure Boot hierarchy

[stgraber]

@gibmat second time failing at the same spot, is tat an actual failure?

[gibmat]

Yeah, something odd is happening; I'll take a look at it in the morning.