Support diskless platforms while having working TOTP/HOTP

Nobody has claimed this yet.

@osresearch @MrChromebox

- TPM reset could check for mounted /boot and if not found, [check if rollback protection is forced](https://github.com/osresearch/heads/blob/c3b0bd6ffbe816430dd41ef54e649af52ed1ff3b/initrd/bin/gui-init#L358-L373)
- [seal-hotpkey](https://github.com/osresearch/heads/blob/c3b0bd6ffbe816430dd41ef54e649af52ed1ff3b/initrd/bin/seal-hotpkey) could do the same.

Maybe cleaner way is to have only one mount_boot function(its duplicated everywhere) and do the validation/mount there for /boot if rollback is required per config instead of duplicating code logic. /boot not being found should show boot options (set new /boot drive etc) while setting new TOTP/HOTP forcing rollback is a bug, not a feature.

The path for resolution:
- Wrap mount_boot at sealing/unsealing with checks for rollback protection being enforced in board config (no board config enforces this by default. Maybe they all should since its the current behavior?)

_Originally posted by @tlaurion in https://github.com/osresearch/heads/issues/999#issuecomment-877314233_

Start with initrd/bin/gui-init and initrd/bin/seal-hotpkey, then compare their duplicated mount_boot handling and the board rollback-protection configuration. Done means diskless systems show boot options when /boot is absent, while setting or sealing TOTP/HOTP does not force rollback when rollback protection is not required.

Written by the indexing model from the issue text.