feat: add disk encryption configuration

[yeetypete]

Encrypts the root filesystem with LUKS2.

TLDR:

systemd-repart definitions in rootfs/usr/lib/ubuntu-bootc/repart.d lay out a 1G ESP and a LUKS2 root filling the disk. install-encrypted.py runs repart, unlocks the volume, and points bootc install to-filesystem --composefs-backend at it. bootc-dev/bootc#2390 recommends this setup, setting encryption up outside bootc rather than using the built in --block-setup tpm2-luks, which is TPM2 only and has no passphrase support.

Details:

The root is formatted with SYSTEMD_REPART_MKFS_OPTIONS_EXT4="-O verity" because composefs needs fs-verity and repart does not enable it by default. And bootc is handed an already open dm-crypt node, so it cannot tell the root is encrypted and the script adds rd.luks.uuid= itself.

just disk builds an encrypted 20G image in a VM, prompting for the passphrase. Not booted yet, so the boot time prompt and the composefs root mount are untested.

Later: add a TPM2 keyslot with systemd-cryptenroll once Secure Boot is on, and check whether discoverable partitions can replace the rd.luks.uuid karg.