When enabling secure boot, it can be a pain to track down all uses of menuentry and submenu to change security flags (eg. defaulting to --unrestricted).

I'd like to propose a new special environment variable named `menu_security', which defines a default that is applied to a configuration if a security flag is not specified on an entry.

I think this would simplify configuration substantially, especially for files other than 10_linux that do not have a CLASS variable defined.

I have a little bit of time this week - I'll try to put together a candidate patch to see what folks think.