Add cryptodisk support for Grub

This adds support for having Grub unlock encrypted partitions. This enables `/boot` to reside in i.e. LUKS container, so that a real full-disk encryption setup is possible.

It is necessary to call `grub-install` with `GRUB_ENABLE_CRYPTODISK=y` in the environment for this to work. It should detect the crypto container and only install successfully if the machine can boot.

I've tested this in an extreme environment: `/boot` on btrfs root partition in LVM in LUKS with an GPT partition table. Boots perfectly with `boot.loader.grub.enableCryptodisk = true` and no further configuration.