sbverify: fix intermediate certificate verification

Openssl verification of partial chains cannot be fixed by checking
error codes in the verify callback (because the errors for
intermediate verified OK and failed are identical).  Instead they must
be fixed by setting the verification flag X509_V_FLAG_PARTIAL_CHAIN
which treats any intermediate cert found as a CA.

Fixes: df27a41 ("sbverify: fix verification with intermediate certificates")
Tested-by: evilteq@anddroptable.net
Tested-by: Steve McIntyre <steve@einval.com>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>