Extension image signing for update-engine

[pothos]

The Flatcar OEM extensions and other optional Flatcar extension images get updates through the regular Flatcar update process. The signed images are part of the Omaha response, in the protobuf format that's also used for the generic update payload. We have to try signing the raw images with the existing tooling and make changes where needed.

[pothos]

For dev builds I've started something here: flatcar/scripts#919
The larger part of work will be the helper scripts for the official manual signing process.
We also need to change the upload script for update.release and to register the extra files with Nebraska.

[pothos]

PR for payload generation: flatcar/flatcar-build-scripts#147

The Nebraska registration with upload_package is still to do.

[pothos]

PR for payload registration: flatcar/flatcar-build-scripts#148