veritysetup: make root-hash-signature=auto optional

systemd-gpt-auto-generator always passes root-hash-signature=auto for
the root and /usr partitions. The data device doesn't have the
ID_DISSECT_PART_ROOTHASH_SIG udev property if the image has no signature
partition. In that case, systemd-veritysetup fails, and the system can't
boot from a verity image that isn't signed. If a signature exists but
neither the kernel nor userspace validates it, we activate the device
without the signature.

The image builder controls whether the image has a signature partition.
Whether the boot requires a signature thus depends on the image
contents. The failure gives no protection, because an image with a
signature that doesn't validate boots. Anyone can avoid the failure by
adding a signature partition with any well-formed signature. Whether a
signature is required must come from the host.
systemd-gpt-auto-generator enables root-hash-signature-required= if
systemd.image_policy= requires a signature. With that option, activation
fails if the signature is missing or invalid.

Let's activate the device without a signature if the property is
missing and root-hash-signature-required= isn't enabled.

NEWS

@@ -79,11 +79,13 @@ CHANGES WITH 263 in spe:
         * systemd-portabled now asks polkit before it inspects extension
           images that are specified by path.
 
-        * systemd-veritysetup gained a root-hash-signature-required= option,
-          which systemd-gpt-auto-generator enables if systemd.image_policy=
-          requires a signature. If the kernel can't validate the root hash
-          signature, systemd-veritysetup now validates it in userspace with
-          the certificates in /etc/verity.d/, like systemd-dissect does.
+        * systemd-veritysetup no longer fails if root-hash-signature=auto
+          finds no signature. It gained a root-hash-signature-required=
+          option, which systemd-gpt-auto-generator enables if
+          systemd.image_policy= requires a signature. If the kernel can't
+          validate the root hash signature, systemd-veritysetup now
+          validates it in userspace with the certificates in
+          /etc/verity.d/, like systemd-dissect does.
 
         * systemd-networkd and networkctl have been merged into a single
           multi-call binary, with the former becoming a symlink to the latter.