tree-wide: Introduce --certificate-source= option

This allows loading the X.509 certificate from an OpenSSL provider
instead of a file system path. This allows loading certficates directly
from hardware tokens instead of having to export them to a file on
disk first.

src/bootctl/bootctl.h

@@ -41,6 +41,8 @@ extern ImagePolicy *arg_image_policy;
 extern bool arg_varlink;
 extern bool arg_secure_boot_auto_enroll;
 extern char *arg_certificate;
+extern CertificateSourceType arg_certificate_source_type;
+extern char *arg_certificate_source;
 extern char *arg_private_key;
 extern KeySourceType arg_private_key_source_type;
 extern char *arg_private_key_source;