verity: add support for setting up verity-protected root disks in the initrd

verity: add support for setting up verity-protected root disks in the initrd

This adds a generator and a small service that will look for "roothash="
on the kernel command line and use it for setting up a very partition
for the root device.

This provides similar functionality to nspawn's existing --roothash=
switch.