add initrd-fs.target and root-fs.target

Instead of using local-fs*.target in the initrd, use root-fs.target for
sysroot.mount and initrd-fs.target for /sysroot/usr and friends.

Using local-fs.target would mean to carry over the activated
local-fs.target to the isolated initrd-switch-root.target and thus in
the real root. Having local-fs.target already active after
deserialization causes ordering problems with the real root services and
targets.

We better isolate to targets for initrd-switch-root.target, which are
only available in the initrd.
cryptsetup-generator: use _cleanup_ where possible