Some distribution hopes to not install the not-signed EFI app by default.
However, for the corner case, the user might still want to use not-signed
one (maybe to work around bugs or do testing). This implements
a logic that uses the not-signed EFI app as the secure boot is off, and
if it does not exist, then we fall back to using the signed one.
Also drop fwupd-unsigned from Recommends of fwupd in debian/control.
The logic was built on the presumption of Ubuntu core which doesn't
have /etc/os-release. Since other distributions do have /etc/os-release
adjust the logic to instead build the path explicitly.
Shim has had a hard time with loading updates from arguments in the
most recent release and this isn't the first time that happened.
Give distros and users an escape hatch that will allow using GRUB
instead.
The end year is legally and functionally redundant, and more importantly causes
cherry-pick conflicts when trying to maintain old branches. Use git for history.
