libsecureboot: make it easier to customize trust anchors

Avoid making hash self-tests depend on X.509 certs.
Include OpenPGP keys in trust store count.

MFC of r347408

Reviewed by: stevek
Sponsored by: Juniper Networks
Differential Revision: https://reviews.freebsd.org/D20208