sandbox: Move BSS after EFI sections
Something went wrong when writing the sandbox linker scripts and so we
ended up with a .bss section marker right before the efi runtime sections.
That obviously is a terrible idea, as it may result in overwriting efi
runtime code and data. So let's move the .bss identifier behind the efi
sections.
Signed-off-by: Alexander Graf <agraf@suse.de>