PM: hibernate: Allow hibernation under lockdown with signed images

Hibernation is unavailable when the kernel is locked down, as an image
could be modified to alter the running kernel when it is restored. With
CONFIG_HIBERNATION_TPM_SIGNATURE, only images signed with a key that the
kernel created are restored, so this no longer applies.

Allow hibernation under lockdown when images are signed. Images are not
encrypted, though, and contain all of kernel memory, which would then be
readable from the swap device or through /dev/snapshot. Add a
LOCKDOWN_HIBERNATION_IMAGE reason at the confidentiality level, so that
hibernation remains unavailable when the kernel is locked down for
confidentiality.

Signed-off-by: Matthew Garrett <matthewg@nvidia.com>