UEFI copies within same archive shouldn't require re-approval

In bug 1016594, it was required that uploads to the primary archive containing a UEFI image tarball should never be auto-approved, in order to allow us to preserve a reasonably Ubuntu-ish upload permissions model without making it trivial for anyone with even the narrowest per-package upload rights to get an arbitrary binary signed with the Canonical UEFI key.

However, this was slightly over the top in that it also affects copies within the same archive. For example, if we publish a security update to GRUB, that will be copied to quantal-updates and the copy must be independently approved, even though the same binary has already been signed with the Canonical key. Similarly, when we opened raring, several UEFI copies landed in the unapproved queue which had already been signed and could have been auto-approved. It'd be nice to eliminate this unnecessary manual work.