boot: skip random seed handling if seed file is marked read-only

If the read-only FAT file attribute is set on /loader/random-seed,
don't update the seed file — and hence don't use it either, since a
seed we cannot update would be the same on every boot.

This gives users an explicit way to turn off random seed handling by
marking the file read-only, useful for example in pre-built OS images
that are replicated to many systems, where the baked-in seed is shared
and hence must not be credited.

The check is done upfront in process_random_seed(), before any other
work, mirroring the existing check for read-only volumes. This covers
both systemd-boot and systemd-stub, which share this code.

Inspired-by: #42979

docs/RANDOM_SEEDS.md

@@ -216,6 +216,13 @@ boot, in order to ensure the entropy pool is filled up quickly.
    too), which should be safe even with FAT file system drivers built into
    low-quality EFI firmwares.
 
+   If the random seed file has the read-only FAT file attribute set, or if the
+   ESP file system is read-only as a whole, the seed is neither updated nor
+   used: a seed that cannot be updated would be identical on every boot, and
+   hence must not be credited. Setting the read-only file attribute on
+   `/loader/random-seed` may thus be used to explicitly turn off random seed
+   handling, for example in OS images that are replicated to multiple systems.
+
 4. A kernel command line option `systemd.random_seed=` may be used to pass in a
    base64 encoded seed to initialize the kernel's entropy pool from during
    early service manager initialization.