move libgcrypt20-hmac to initrd, as gpg and libgcrypt20 live there

otherwise fips=1 fails in /linuxrc already