kern: add an option for preserving the early kenv

Some downstream configurations do not store secrets in the
early (loader/static) environments and desire a way to preserve these
for diagnostic reasons. Provide an option to do so.

(cherry picked from commit 7a129c973b5ba0fa916dfa658d523bec66dbd02d)