feat: disable kernel lockdown mode for azurelinux 3.0 aks image

[miz060]

What this PR does / why we need it:
The AzureLinux 3.0 kernel auto-enables lockdown when secure boot is detected via an OOT patch. Disable kernel lockdown by default to enable AKS customer installing their own custom GPU driver when using azurelinux 3.0.

Which issue(s) this PR fixes:

Fixes #

Validation:

• aks-image-build: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1058779&view=results
• manually validated in AKS cluster that kernel lockdown is disabled when Secure Boot is off, and set to integrity when Secure Boot is on.

[Copilot]

Pull request overview

Disables the Azure Linux 3.0 kernel cmdline lockdown=integrity setting during VHD build, to prevent lockdown being forced on in scenarios where customers need to install custom GPU drivers.

Changes:

• Added a Mariner/Azure Linux helper function to remove the kernel lockdown cmdline argument using grubby.
• Invoked this helper during pre-install-dependencies.sh for Azure Linux 3.0 builds.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
vhdbuilder/scripts/linux/mariner/tool_installs_mariner.sh	Adds disableKernelLockdownCmdline() to remove lockdown args from the kernel cmdline.
vhdbuilder/packer/pre-install-dependencies.sh	Calls disableKernelLockdownCmdline for Mariner/Azure Linux when OS_VERSION is 3.0.

[Copilot]

disableKernelLockdownCmdline prints that it is removing lockdown=integrity, but the command uses --remove-args="lockdown" and does not check the grubby exit code. This can either remove more than intended (e.g., other lockdown modes) or silently fail to remove the specific lockdown=integrity arg, leaving the VHD in the problematic state. Please (1) remove the exact arg you intend (e.g., lockdown=integrity) and/or validate the resulting cmdline, and (2) fail the build if the grubby update fails (consistent with the dnf_install error handling).

Suggested change

	grubby --update-kernel=ALL --remove-args="lockdown"
	grubby --update-kernel=ALL --remove-args="lockdown=integrity" || exit $ERR_APT_INSTALL_TIMEOUT
	# Verify that lockdown=integrity has been removed from all kernels' cmdlines.
	if grubby --info=ALL | grep -q 'lockdown=integrity'; then
	echo "Failed to remove lockdown=integrity from kernel cmdline."
	exit $ERR_APT_INSTALL_TIMEOUT
	fi