sysext: Get verity user certs from given --root=

The verity user certs weren't looked up in the given --root= for
systemd-sysext which made it fail to set up extensions with a strict
image policy.
Look up verity user certs from inside the --root= when we operate on
images in it. The main use case where this matters is when the initrd
sets up the extensions for the final system and thus systemd-sysext
should do the same thing as it would do in the final system.

src/mountfsd/mountwork.c

@@ -540,6 +540,7 @@ static int vl_method_mount_image(
 
         r = dissected_image_decrypt(
                         di,
+                        /* root= */ NULL,
                         p.password,
                         &verity,
                         use_policy,