factory: installation from initrd must apply dbx revocations

[xnox]

today dbx revocations are applied from the base snap upon install mode boot.

If install mode boot is never performed, dbx revocations must be applied before sealing luks key on EFI capable platforms.