All devices that have active PCIe channels that were authorized by
the firmware (in contrast to the user) should be imported. The
policy 'iommu' should be used for most of them since the only case
where it is safe to use 'auto' in 'user' SL1 when the boot flag
is not set and iommu is not active.
Additionally code to handle the impossible case of 'secure' mode
with a valid key but a boot flag is removed, because that can
never actually happen in the wild.