Rebase the kernel lockdown patch set
    
    Use the latest version of the kernel lockdown patch set. This includes a
    few configuration renames:
    
    CONFIG_KEXEC_VERIFY_SIG became CONFIG_KEXEC_SIG and
    CONFIG_KEXEC_SIG_FORCE was added. CONFIG_KEXEC_SIG_FORCE=n because the
    "kexec_file: Restrict at runtime if the kernel is locked down" patch
    enforces the signature requirement when the kernel is locked down.
    
    CONFIG_LOCK_DOWN_MANDATORY got renamed to CONFIG_LOCK_DOWN_KERNEL_FORCE
    and remains false as LOCK_DOWN_IN_EFI_SECURE_BOOT covers enabling it for
    EFI Secure Boot users.
    
    Finally, the SysRq patches got dropped for the present.