[ci] Schedule Coverity Scan run via GitHub Actions

[release] Release version 2.9.0

[efi] Convert Secure Boot status message to a debug print

[qa] Enable Secure Boot for Windows 11 (UEFI) test

[qa] Add certificate and non-private key for automated Secure Boot tests

[efi] Show Secure Boot status before starting bootmgfw.efi

[efi] Update to current EDK2 headers and elf2efi.c

[build] Use -fshort-wchar when building EFI host utilities

[qa] Test extraction of BCD file from WIM image

[doc] Update changelog

[efi] Automatically select a suitably signed next stage bootloader

[wim] Always use extracted filename as-is

[efi] Ensure that booted image always has the expected filename

[qa] Switch to using "q35" machine type for Windows 11 UEFI test

[efi] Extract boot.stl file from WIM image