uefisign reported every outcome other than success with an exit status of
1, so a caller could not tell "this binary is not signed" from "the
certificate would not parse" or "the crypto library is broken".

This can be useful for a tool such as the automatic bootloader updated
discussed in D58990.

Split the status into two ranges. A small value is a statement about the
file that was examined: 1 for the wrong signature state (not signed under
-V, already signed when signing), 2 for a file that is not a conforming
UEFI PE image. A failure of uefisign itself is reported with a value from
<sysexits.h>, which implies nothing about the file. A child killed by a
signal now exits 128 plus the signal number, so a status of 0 can no
longer mean that uefisign died.

What uefisign accepts, rejects and produces is unchanged: signing
loader.efi, loader_simp.efi, loader_ia32.efi, gptboot.efi and boot1.efi
gives byte-identical output before and after.

PR: 298383
Sponsored by: Defenso

Signed-off-by: Quentin Thébault <quentin.thebault@defenso.fr>