dissect/nspawn: add support for dm-verity root hash signature

Since cryptsetup 2.3.0 a new API to verify dm-verity volumes by a
pkcs7 signature, with the public key in the kernel keyring,
is available. Use it if libcryptsetup supports it.

shell-completion/bash/systemd-nspawn

@@ -71,7 +71,7 @@ _systemd_nspawn() {
                       --pivot-root --property --private-users --network-namespace-path --network-ipvlan
                       --network-veth-extra --network-zone -p --port --system-call-filter --overlay --overlay-ro
                       --settings --rlimit --hostname --no-new-privileges --oom-score-adjust --cpu-affinity
-                      --resolv-conf --timezone'
+                      --resolv-conf --timezone --root-hash-sig'
     )
 
     _init_completion || return
@@ -183,6 +183,10 @@ _systemd_nspawn() {
             --timezone)
                 comps=$( systemd-nspawn --timezone=help 2>/dev/null )
                 ;;
+            --root-hash-sig)
+                compopt -o nospace
+                comps=$( compgen -A file -- "$cur" )
+                ;;
         esac
         COMPREPLY=( $(compgen -W '$comps' -- "$cur") )
         return 0