grub2 release 2.06-13 for sid

CEBB52301D617E910390FE16587979573442684E

grub2 release 2.06-3 for unstable (sid) [dgit]

[dgit distro=debian no-split --quilt=linear]

4FB588A84C2DDE79A74C77876FA458DD1DB03F71

Closes: #1034409

Add debconf logic for GRUB_DISABLE_OS_PROBER to make it easier to
control things here. Particularly useful for the installer.
Closes: #1031594, #1012865.

Add arm64-handover-to-kernel-if-sb-enabled.patch

See merge request grub-team/grub!32

Fix Secure Boot on arm64 with patch
arm64-handover-to-kernel-if-sb-enabled.patch.

Fix: #1033657

- disk/cryptodisk: When cheatmounting, use the sector info of the cheat
  device
- osdep/devmapper/getroot: Have devmapper recognize LUKS2
- osdep/devmapper/getroot: Set up cheated LUKS2 cryptodisk mount from DM
  parameters

Thanks for tracking this down Antoine!

I've mostly retired from GRUB maintenance since early 2022, so I think
it would be better if I weren't listed as an uploader in bookworm.
Thanks to Steve and Julian for picking up the torch!

Closes: #1030846

Closes: #1026915. Thanks to Pascal Hambourg for the patch.

It only causes problems. Closes: #1016737

Fixes #845683

to install onto devices

Apply patch from upstream,

Closes: #1001414

Closes: #1026092

Also needs backports from upstream commits to fix warnings/errors
from using gcc 12:

be8eb0eed util/mkimage: Fix dangling pointer may be used error
acffb8148 build: Fix -Werror=array-bounds array subscript 0 is outside array bounds
3ce13d974 lib/reed_solomon: Fix array subscript 0 is outside array bounds

Closes: #1021846. Thanks to программист некто for helping to debug the
problem!

Make font fallback handling work!

Due to a mistake in the buster update that left the CVE-2022-2601 bugs
in place, we need to bump SBAT for all of the Debian GRUB binaries. :-(

The previous security updates disallowed loading unsigned fonts when
in SB mode. To make things work again:

 * Embed the "unicode" font into the embedded memdisk image so it can
   be loaded.
 * Add the memdisk to our normal grubx64.efi loader too
 * Add a patch from Chris Coulson to make the font loader look for
   fonts in the memdisk whenever they're loaded.

Closes: #1024395, #1025352, #1024447