Fixed case where a LUKS root is protected by a GPG-encrypted keyfile
and plymouth is in use. Previously, this would use plymouth's
ask-for-password action, passing it a --command argument that
included a pipeline (line 206 in previous version of 00-crypt.sh).
As plymouth does not shell-interpret its command however, this fails.
In this version, we create a temporary script file with the necessary
pipeline command in it, and pass this temporary script to plymouth instead.
The temporary script is deleted after use.
(In theory, it should be possible to construct a "/bin/sh -c 'cmd'"-style
invocation for the --command, thereby avoiding this, but I have had no
luck with this approach, due to plymouth's argument parser.)