Enable NSS PKIX verifier for secureboot signature checks

[cbgbt]

During image creation, bottlerocket uses the pesigcheck utility to verify secureboot signatures on all signed artifacts. The signature validation is implemented via libnss.

Bottlerocket SDK 0.43.0 release will move to NSS 3.101.

In NSS 3.101, lib::pkix was enabled as the default X.509 validator. This causes pesigcheck to fail with "Peer's Certificate issuer is not recognized," despite the CA issuer being provided to pesigcheck for the check.