track profile signed status in subsystem storage

[jessepeterson]

Our parsing library can tell us whether a profile is signed or not. So we can track this.

The particular need here is the public key (certificate) injection for a FileVault enable profile. If the profile is signed and we do a text replacement the signature will be broken. So track signed status and issue an error if we try to use a signed profile.