credentials: add policy that can allow key=null creds from the ESP (#42555)

This PR only sets the default to "relaxed" - I can change the default
to "tofu" if desired. But for that we will also need to update the NEWS
file to ensure everyone is aware of this new default.

---

This PR adds a new `systemd.credentials-boot=` kernel
commandline that allows to control if credentials with
a `null` key are accepted.

The possible options are:
* strict: always insist on tpm encryption
* tofu: allow null encryption in firstboot mode and when no tpm is
available
* relaxed: allow null encryption when sb is off, or no tpm is available
* off: allow null encryption always

The default is `relaxed` which is exactly the behavior we had before.

This replaces the initial idea of using plaintext credentials
at firstboot (thanks to Lennart for this nicer and simpler design).

---

With that we can drop `- firstboot: optionally accept credentials at
firstboot without authentication` from TODO.md

src/basic/initrd-util.c

@@ -38,3 +38,27 @@ bool in_initrd(void) {
 void in_initrd_force(bool value) {
         saved_in_initrd = value;
 }
+
+int in_first_boot(void) {
+        static int first_boot_env_parse_cached = -1;
+        int r;
+
+        if (first_boot_env_parse_cached >= 0)
+                return first_boot_env_parse_cached;
+
+        r = secure_getenv_bool("SYSTEMD_FIRST_BOOT");
+        if (r >= 0)
+                return (first_boot_env_parse_cached = r);
+        if (r != -ENXIO)
+                log_debug_errno(r, "Failed to parse $SYSTEMD_FIRST_BOOT, ignoring: %m");
+
+        /* This is not cached and must *never* be cached, other parts of systemd write it to signal
+         * an update to the first-boot state. */
+        r = RET_NERRNO(access("/run/systemd/first-boot", F_OK));
+        if (r >= 0)
+                return true;
+        if (r == -ENOENT)
+                return false;
+
+        return log_debug_errno(r, "Failed to check /run/systemd/first-boot: %m");
+}

src/basic/initrd-util.h

@@ -5,3 +5,5 @@
 
 bool in_initrd(void);
 void in_initrd_force(bool value);
+
+int in_first_boot(void);