Add cryptodisk support for Grub

This PR adds support for having Grub unlock encrypted partitions. This enables `/boot` to reside in i.e. a LUKS container, so that a real full-disk encryption setup is possible.

It is only necessary to call `grub-install` with `GRUB_ENABLE_CRYPTODISK=y` in the environment for this to work. Grub should detect the crypto container and only install successfully if the machine can boot.

I have tested this in an extreme environment: `/boot` on btrfs root partition in LVM in LUKS with an GPT partition table. Boots perfectly with `boot.loader.grub.enableCryptodisk = true` and no custom `boot.loader.grub.extraConfig`.