Add an option to generate the expected volume key hash for LUKS volumes by systemd-repart and put it to crypttab, make systemd-cryptsetup check it upon attaching. The format of the hash matches what's currently being measured to TPM2 PCR with tpm2-measure-pcr=. Closes #40123