units: make use of nvpcrs only after the NV anchor completion measurement is done

This makes sure we don't use the "hardware" or "verity" nvpcrs before
the NV anchor measurement is done.

This is mostly to avoid confusing output, and to indirectly ensure the
nvpcr allocation in tpm2-setup is the load bearing one, but it should
not be load bearing for security afaics.

units/systemd-pcrnvdone.service.in

@@ -13,7 +13,7 @@ Documentation=man:systemd-pcrnvdone.service(8)
 DefaultDependencies=no
 Conflicts=shutdown.target
 After=systemd-tpm2-setup-early.service systemd-tpm2-setup.service
-Before=sysinit.target shutdown.target
+Before=sysinit.target cryptsetup-pre.target cryptsetup.target shutdown.target
 ConditionSecurity=measured-os
 ConditionPathExists=!/etc/initrd-release
 FailureAction=reboot-force

units/systemd-pcrproduct.service.in

@@ -12,7 +12,7 @@ Description=TPM NvPCR Product ID Measurement
 Documentation=man:systemd-pcrproduct.service(8)
 DefaultDependencies=no
 Conflicts=shutdown.target
-After=tpm2.target
+After=tpm2.target systemd-pcrnvdone.service
 Before=sysinit.target shutdown.target
 RequiresMountsFor=/var/lib/systemd/nvpcr
 ConditionPathExists=!/etc/initrd-release