Keep the MOK password off the command line it was promised off of

The comment above the prompt says the password never reaches a command
line; --generate-hash="$first" put it on one, world-readable in
/proc/<pid>/cmdline while mokutil ran. It now arrives on stdin, and the
hash is taken from the last output line because mokutil prints its
prompts to stdout too.

setup/scripts/interview

@@ -122,7 +122,12 @@ if [[ -n "$nvidia_card" ]]; then
                     fi
                     second="$(gum input --password --header "MOK password again")"
                     if [[ "$first" == "$second" ]]; then
-                        mok_hash="$(mokutil --generate-hash="$first")"
+                        # Fed on stdin, never as an argument: an argument sits
+                        # in /proc/<pid>/cmdline for any local process to read
+                        # while mokutil runs. mokutil prints its two prompts on
+                        # stdout too, so the hash is the last line.
+                        mok_hash="$(printf '%s\n%s\n' "$first" "$first" \
+                            | mokutil --generate-hash | tail -n 1)"
                         break
                     fi
                     printf 'Those did not match.\n'