kernel: microcode in every initramfs through mkinitcpio's microcode hook (issue 1977)

Declares amd-ucode and intel-ucode, the drop-in /etc/mkinitcpio.conf.d/mesh-microcode.conf, the
initramfs script and mesh-kernel-initramfs.service; kernel_boot answers the running revision and
whether the images were built with the drop-in. Tests: 1977/AC1-AC5.

Builds: L1, L2, L3, L4, L5 (issue 1977 note 2)

modules/kernel/files/mesh-kernel-initramfs.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=The initramfs images with the CPU's current microcode
+# Module kernel, novox/hq issue 1977. Starting this unit builds the images again when the microcode drop-in
+# changed since they were last built; a failed mkinitcpio fails the unit. The microcode packages are declared
+# before this unit.
+After=local-fs.target
+Wants=local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=${dir:state}/initramfs apply
+# It writes the boot partition and its own state; mkinitcpio keeps its work in a private /tmp.
+ProtectSystem=strict
+ReadWritePaths=/boot ${dir:state}
+PrivateTmp=yes
+ProtectHome=yes
+PrivateNetwork=yes
+NoNewPrivileges=yes
+
+[Install]
+WantedBy=multi-user.target