grub module: add extraInitrd option

[symphorien]

Motivation for this change

This adds a NixOS option which enables to configure grub to give the kernel a second ,additional initramfs.

My use case is the following:
I have a LUKS encrypted root filesystem, and no /boot partition. Grub asks me a passphrase to open /, read its configuration in /boot and then loads the kernel.
The initramfs then asks me the same passphrase a second time to mount /.
The solution is to create a LUKS keyfile, readable by root only, and put it in the initramfs so that stage1 doesn't need the passphrase anymore. But because of issue #8 one cannot but secret files in the store and thus in the initramfs.
So I have a second, static initramfs in /boot/custom_initramfs/initramfs.gz, readable by root only, and containing only the keyfile /key and the following setup:

boot.loader.grub = {
...
enableCryptodisk=true;
extraInitrd=/boot/custom_initramfs/initramfs.gz;
};  
boot.initrd.luks.devices = [ { 
...
keyFile="/key";
} ];

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

---

Only tested on grub2, although the syntax should be the same with grub1.

[mention-bot]

@symphorien, thanks for your PR! By analyzing the history of the files in this pull request, we identified @edolstra, @wkennington and @obadz to be potential reviewers.

[joachifm]

The example needs to be quoted, otherwise the evaluator will try to actually read it.

[symphorien]

Sorry, this is now fixed.

[fpletz]

Wow, awesome. Didn't know you could add a second initrd. What are the semantics here? Does the kernel just mount the second initrd over the first one are the contents copied? Seems a bit weird at first glance that the contents of both initrds are available at /.

[dezgeg]

The contents are copied. The cpio format that's used for initrds cannot be mounted as it doesn't support efficient random access.

[fpletz]

Thanks for the explanation @dezgeg!