Signed-off-by: Sayan Chowdhury <schowdhury@microsoft.com>

Continue supporting BIOS by passing `-bios` and only enable `smm=on` when
secure boot is requested, as it requires build of OVMF code. This special build
is required for secure boot support, but non-sboot OVMFs won't support it.

and cleanup on shutdown.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>

To make this change easier to apply to all channels.

Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>

Kernel lockdown blocks loading unsigned kernel modules, so these tests need to
be disabled. Eventually the zfs sysext should ship a signed kernel modules, but
falco is built on the running system and won't work the same way. Falco
suggests running in eBPF mode instead.