Support transitioning to Deployed Mode

[quite]

I think it would be nice if sbctl would try to transition Secure Boot to "Deployed Mode". If that is doable.
Then there cannot be any mistaken transition (carried out by anyone) to "Audit Mode" (support for which would be nice, but that's something else)

Figure 32.4 here is a nice ref: https://uefi.org/specs/UEFI/2.11/32_Secure_Boot_and_Driver_Signing.html#firmware-os-key-exchange-creating-trust-relationships

[quite]

Oh, if one reads this variable list a little more carefully, the description for exactly AuditMode and DeployedMode says Always becomes read-only after ExitBootServices() is called. https://uefi.org/specs/UEFI/2.11/03_Boot_Manager.html#globally-defined-variables

So I think we won't be able to transition to Deployed Mode, then. (sorry for the noise, probably)