nixos/limine: fix fwupd-efi signing script under strict shell checks

The signing service builds `fwupd_efi` as a bash array but referenced
it as a scalar, tripping SC2128 (array expanded without index) and
SC2046 (unquoted command substitution). With enableStrictShellChecks
these are promoted to errors, breaking the unit-script build when
secureBoot, fwupd and strict shell checks are all enabled.

Loop over the array and sign every matched fwupd EFI binary, quoting
the basename and the -o argument. Indexing a single element would
silently skip any additional files the glob matches.

Assisted-by: claude-code with claude-opus-4-8[1m]-high

nixos/modules/system/boot/loader/limine/limine.nix

@@ -503,7 +503,9 @@ in
 
         script = ''
           fwupd_efi=(${config.services.fwupd.package.fwupd-efi}/libexec/fwupd/efi/fwupd*.efi)
-          ${lib.getExe cfg.secureBoot.sbctl} sign -o /run/fwupd-efi/$(basename "$fwupd_efi").signed "$fwupd_efi"
+          for efi in "''${fwupd_efi[@]}"; do
+            ${lib.getExe cfg.secureBoot.sbctl} sign -o "/run/fwupd-efi/$(basename "$efi").signed" "$efi"
+          done
         '';
       };