ukify: merge example config file section

Since the example config file is generated in order of ConfigItems this added a
second [UKI] section

    [UKI]
    …
    SignKernel = SIGN_KERNEL

    [PCRSignature:NAME]
    PCRPrivateKey = PCR_PRIVATE_KEYS
    PCRPublicKey = PATH
    PCRCertificate = PATH
    Phases = PHASE-PATH…
    PolicyRef = STRING

    [UKI]
    SignInitrdPCRs = SIGN_INITRD_PCRS

which becomes

    [UKI]
    …
    SignKernel = SIGN_KERNEL
    SignInitrdPCRs = SIGN_INITRD_PCRS

    [PCRSignature:NAME]
    PCRPrivateKey = PCR_PRIVATE_KEYS
    PCRPublicKey = PATH
    PCRCertificate = PATH
    Phases = PHASE-PATH…
    PolicyRef = STRING

with this change.

(cherry picked from commit ceca50d7a6f4c80a392b7e74aeb6b6cf11e58bf6)

src/ukify/ukify.py

@@ -2297,6 +2297,12 @@ CONFIG_ITEMS = [
         help='Sign the embedded kernel',
         config_key='UKI/SignKernel',
     ),
+    ConfigItem(
+        '--sign-initrd-pcrs',
+        action=argparse.BooleanOptionalAction,
+        help='additionally sign PCR policies that can only be satisfied from the initrd',
+        config_key='UKI/SignInitrdPCRs',
+    ),
     ConfigItem(
         '--pcr-private-key',
         dest='pcr_private_keys',
@@ -2363,12 +2369,6 @@ CONFIG_ITEMS = [
         action=argparse.BooleanOptionalAction,
         help='print systemd-measure policy digests for the UKI',
     ),
-    ConfigItem(
-        '--sign-initrd-pcrs',
-        action=argparse.BooleanOptionalAction,
-        help='additionally sign PCR policies that can only be satisfied from the initrd',
-        config_key='UKI/SignInitrdPCRs',
-    ),
     ConfigItem(
         '--json',
         choices=('pretty', 'short', 'off'),