initrdscripts: Make cryptsetup fail hard in unexpected conditions

This patch adds a set of checks that make sure that the partition layout is as expected on a system with encrypted disks. Namely it

Forces the cryptsetup hook to run when in secure boot user mode
Checks that the boot partition is split
Checks that it can find the correct amount of encrypted partitions
Checks that the label on the unlocked filesystem matches the label on the encrypted partition
Checks that system is not mixing encrypted and unencrypted partitions
Checks there are no ambiguities or duplicit partitions

Change-type: patch

[ ] Changes have been tested
- [ ] Covered in automated test suite
- [ ] Manual test case recorded
[ ] Change-type present on at least one commit
[ ] Signed-off-by is present
[ ] The PR complies with the Open Embedded Commit Patch Message Guidelines

When submitting a review, please pick:
- 'Approve' if this change would be acceptable in the codebase (even if there are minor or cosmetic tweaks that could be improved).
- 'Request Changes' if this change would not be acceptable in our codebase (e.g. bugs, changes that will make development harder in future, security/performance issues, etc).
- 'Comment' if you don't feel you have enough information to decide either way (e.g. if you have major questions, or you don't understand the context of the change sufficiently to fully review yourself, but want to make a comment)

balena-os / meta-balena