selftests/bpf: Add tests for bpf keyring in signed loader

bpf_keyring_provisioned walks the keyring through its whole lifecycle in
one boot for ease of testing. It enrolls a freshly generated key into the
bpf keyring, confirms a load is still refused with -ENOKEY while the keyring
carries no restriction, then restricts it, and only then does the same
signed BPF program load with the bpf keyring. A caller-supplied keyring is
asserted to be refused both before and after the restriction, since what
refuses it is bpf.keyring_unsealed=1 rather than the state of the keyring.

Unsealing is a boot-time decision which also refuses the caller-supplied
keyrings that most subtests here sign against, so each subtest is tagged
with the boot it needs and the ones which cannot run report as skipped
instead of being dropped.

Regular run:

  # LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t signed_loader
  [...]
  #425/12  signed_loader/signature_zero_size:OK
  #425/13  signed_loader/signature_bad_keyring:OK
  #425/14  signed_loader/bpf_keyring_sealed:OK
  [...]
  #425/30  signed_loader/signed_map_by_fd_rejected:OK
  #425/31  signed_loader/signed_sparse_fd_array_rejected:OK
  #425/32  signed_loader/bpf_keyring_provisioned:SKIP
  #425     signed_loader:OK (SKIP: 1/32)
  Summary: 1/31 PASSED, 1 SKIPPED, 0/0 FAILED

Unsealed run:

  # KERNEL_CMDLINE_EXTRA="bpf.keyring_unsealed=1" \
    LDLIBS=-static PKG_CONFIG='pkg-config --static' ./vmtest.sh -- ./test_progs -t signed_loader
  #425/1   signed_loader/loadtime_no_map:SKIP
  #425/2   signed_loader/loadtime_with_map:SKIP
  #425/3   signed_loader/metadata_match:OK
  [...]
  #425/30  signed_loader/signed_map_by_fd_rejected:SKIP
  #425/31  signed_loader/signed_sparse_fd_array_rejected:SKIP
  #425/32  signed_loader/bpf_keyring_provisioned:OK
  #425     signed_loader:OK (SKIP: 17/32)
  Summary: 1/15 PASSED, 17 SKIPPED, 0/0 FAILED

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260828175227.1537793-11-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>