feat: expose systemd cert enrollment configuration of LiveCD in enki

[mudler]

Is your feature request related to a problem? Please describe.
When we know that the certificate works for UKI installations, it is cumbersome to have to do manually install the keys. There are also cases where it is not possible to install/append keys manually.

Describe the solution you'd like
enki to have a flag option to expose the systemd-boot (in the LiveCD only) option (secure-boot-enroll) https://www.freedesktop.org/software/systemd/man/latest/loader.conf.html

Describe alternatives you've considered
N/A

Additional context
Enki should default to if-safe, but the user should be allowed to override this setting via CLI args

This is to work in tandem with #2418 to have ISOs that automatically enroll certificates from the vendor + user-generated if those can be exported by the HW bios.