Build shim 15.4 from tarball

For shim 15.4 upstream review requires that we build from a tarball
(https://github.com/rhboot/shim/releases/download/15.4/shim-15.4.tar.bz2)
rather than the git tag.  The most obvious reason for this seems to be
that the tarball contains required gnu-efi files, while the tag does
not.  The original git clone commands have been left in the Dockerfile
to revert to should future submissions to back to the tag-based builds.