Adding qubes-test distro public key to test QubesOS ISOs

[tlaurion]

Permits USB boot of verified ISOs QubesOS 4.1 ISOs downloaded from https://qubes.notset.fr/iso/

Once again, verified ISO boot requires detached signature to be put alongside ISO under Heads:

• https://qubes.notset.fr/iso/Qubes-20210725-x86_64.iso.asc
• https://qubes.notset.fr/iso/Qubes-20210725-x86_64.iso

Fixes #1010

Notes:

• QubesOS 4.1 Installer boots under Sandy/Ivy bridge with coreboot 4.13 + vbt added in coreboot, while actually successful installation is still blocked by QubesOS 4.1 installer over Heads ISO boot: blivet doesn't find mount attribute on already mounted loopback device for install when installing packages QubesOS/qubes-issues#6792. A workaround is to dd ISO to USB drive and boot without having the ISO verified against detached signature file.
• Setting a Disk Unlock Key to be released by TPM under Heads (so that the LUKS Disk Unlock Key is released by TPM only if LUKS header is valid (measured under PCR6) + monsistent PCRs measurement depends on cryptsetup2 being added under board configuration (Makefile: Add cryptsetup2 missing statement into Makefile #1013)

x230-hotp-maximized test build can be downloaded from here.

Initial flash external reprogramming

• https://1243-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1047-g72b15ee-bottom.rom
• https://1243-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1047-g72b15ee-top.rom

Internal full opaque SPI repgrogramming (upgrade through Heads flash menu)

• https://1243-103208611-gh.circle-artifacts.com/0/build/x230-hotp-maximized/heads-x230-hotp-maximized-v0.2.0-1047-g72b15ee.rom

[tlaurion]

QubesOS investigating why Q4.1 iso doesn't install software while same verified boot works for Fedora 32 ISO here

[tlaurion]

To ease tests, I think the key should be added without waiting for the problem to be resolved (Heads boots ISO fine with this distro public key added to the rom.)

@MrChromebox : please approve.