Spin-off from bug 1189841.

From https://github.com/openSUSE/suse-module-tools/pull/33:

@mwilck:
so why not test this? e.g. like this:

if [ "$(mokutil --sb-state 2>/dev/null)" = "SecureBoot enabled" ]; then
    ...
fi

@hramrach:

???

The part that github displays as context for this comment does not look
relevant
@hramrach hramrach 21 hours ago Member

Right, if you refer to
XXX: Only call mokutil if UEFI and shim are used

then I have no opinion on that.

Should be probably handled in a separate bug and the implications of any
possible check discussed to death.
@hramrach hramrach 21 hours ago Member

Actually, there is the problem that on arm64 you suddenly get from no shim to
shim on SP update without any warning so this is really hairy to get right.
Really deserves a separate bug.