dissect-image: guess verity root hash from the resources we found

When dissecting an image, let's make use of the Verity data even if we
got told no root hash explicitly: we can simply determine it by
concatenating the data partition uuid with the verity partition uuid.

Of course, on first thought this doesn't really add much: if the root
hash is not pinned from somewhere, this does not guarantee trust in
the image.

However, this is very useful for attestation: if we have the root hash
we can measure it before mounting things, even if we don't actually
authenticate it.

Hence, at best this helps us with attestation, at worst it doesn't improve
security but certainly doesn't hurt it.

src/nspawn/nspawn.c

@@ -6391,10 +6391,20 @@ static int run(int argc, char *argv[]) {
                                         dissected_image,
                                         loop->fd,
                                         &arg_verity_settings);
-                        if (r < 0)
+                        if (r < 0) {
+                                log_error_errno(r, "Failed to load Verity signature partition: %m");
                                 goto finish;
+                        }
 
-                        if (dissected_image->has_verity && !arg_verity_settings.root_hash && !dissected_image->has_verity_sig)
+                        r = dissected_image_guess_verity_roothash(
+                                        dissected_image,
+                                        &arg_verity_settings);
+                        if (r < 0) {
+                                log_error_errno(r, "Failed to guess Verity root hash: %m");
+                                goto finish;
+                        }
+
+                        if (dissected_image->has_verity && !arg_verity_settings.root_hash)
                                 log_notice("Note: image %s contains verity information, but no root hash specified and no embedded "
                                            "root hash signature found! Proceeding without integrity checking.", arg_image);