sd-id128: do stricter checking of random boot id

If we are bothering to check whether the kernel is not feeding us
bad data, we might as well do it properly.

CID #1237692.
man: say that SecureBits= are space separated