efirt: Add tunable to allow disabling EFI Runtime Services

Leading up to enabling EFIRT in GENERIC, allow runtime services to be
disabled with a new tunable: efi.rt_disabled. This makes it so that EFIRT
can be disabled easily in case we run into some buggy UEFI implementation
and fail to boot.

Discussed with: imp, kib
MFC after: 1 week