m4: store encryption keys in the "extra" partition
m4: don't mount anything in /data

Otherwise, encryption will fail to unmount it cleanly. Inspired by what
m7 does.
Merge pull request #6 from u-ra/cm-11.0

Encryption fixes