Create Whiptail menu to guide through OEM device ownership

[tlaurion]

@kylerankin : I'll put it in my pile by if it is easy for you, don't hesitate!

[tlaurion]

Works flawlessly here.

[tlaurion]

Continuing discussion that happened here

@tlaurion fair enough, that's fine with me. I don't have any concerns (as long as it can be bypassed in case the deletion didn't work or the file shows up again accidentally).

@kylerankin That /boot/oem file could even be provisioned with OEM name, and while at it, contain pregenerated passphrases to feed the OEM reownership process with if desired (Easy: GPG Name, e-mail, comment, admin and user PINs. Need deeper changes: Disk Recovery Key passphrase, Disk Unlock Key passphrase, TPM reownership password). The OEM could then easily provide the user with those initial provisioned secrets prior to delivery, with TOTP scanned QR code, over secured communication channel.

That way, the OEM could keep a single deployment base image up to date, clone it to other to be shipped laptops while using the same OEM reownership process himself to prepare hardware, skipping (most. TOTP QR code screen capture would still be manually required) user prompts.

The OEM using the (re)ownership himself would permit to not sacrifice uniqueness of Disk Recovery Key, guaranteeing to the user that the OEM doesn't even have the shipped disk LUKS header himself while saving OEM hardware preparation time, bounding seamlessly the LibremKey/NitroKey to that laptop. That will be my next step in making OEM delivery of preinstalled QubesOS easier for both OEM and end users.

Working OEM reownership code (not including precedent proposition) with a lot of other fixes and x230 staging images here

[tlaurion]

#551