Apply Secure Boot updates for newer certificates

This policy sets the registry key needed to apply the updated Secure Boot denylist (DBX), the new signing certificate in the allowlist (DB), the anti-rollback mechanism (SVN), and the Code Integrity Boot Policy, to prevent untrusted/vulnerable Windows boot managers from loading when Secure Boot is turned on. IMPORTANT: Carefully read the Microsoft documentation associated with this protection, as it can render your device unable to boot if you do not follow the required preliminary steps: - https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932 A FAQ and extensive documentation about this mitigation is available in the following article, which you should read carefully before deploying this policy, to make sure you understand the implications and the necessary steps to take before enabling it: - https://support.microsoft.com/en-us/topic/windows-secure-boot-certificate-expiration-and-ca-updates-7ff40d33-95dc-4c3c-8725-a9b95457578e In particular, you should read all the step descriptions present in the list and the associated manual operations you need to perform (reboots, additional checks, etc.) for each of them in the documentation section: - https://support.microsoft.com/en-us/topic/kb5025885-how-to-manage-the-windows-boot-manager-revocations-for-secure-boot-changes-associated-with-cve-2023-24932-41a975df-beb2-40c1-99a3-b3ff139f832d#bkmk_mitigation_guidelines