Prepare for future OpenSSL API changes.

OpenSSL 4.1 deprecates ASN1_STRING_set. Move to ASN1_STRING_set0 which requires the DER buffer to be allocated with OPENSSL_zalloc so ownership can be assumed by the string.

A loader.efi signed is byte-for-byte identical to one signed previously.