feat: add secure boot USB mass storage scripts for CM4

- Added gen-secure-msd-sig.sh to sign boot.img with private key using rpi-eeprom-digest
- Added rpi-boot-secure.sh to load signed secure-boot mass storage gadget via rpiboot
- Updated .gitignore to exclude usbboot/ directory
- Updated README with secure boot CM4 unlock instructions

README.md

@@ -52,3 +52,8 @@ For production, the devices need to be provisoned uniquely
     - start the application (script if custom device, server and frontend if ui version)
     - set mac add of secondary eth port in /etc/systemd/network/10-eth1-mac.link
     - activate overlayfs (?) -probably not because we need persistent storage for stream states
+
+## Secure-boot CM4: unlock secure USB mass-storage
+bash gen-secure-msd-sig.sh
+bash rpi-boot-secure.sh
+