feat(boot): make strict mode follow systemd-boot's selection and menu rules

In strict mode a one-shot entry only becomes the default, the default
entry may be one with no boot counter tries left, no menu timeout means a
hidden menu, the menu is shown again when a started image returns, and
entries that mix linux, efi and uki, entries whose file is missing, and
unified kernel images with no name are hidden. Plain EFI entries are not
counted, the XBOOTLDR partition is always read, and a devicetree that
can't be installed fails the entry.

Outside of strict mode these keep working as they did, and each one is
now logged where it applies. The initrd limit of BLS entries is 32.
A devicetree that can't be installed is skipped with a warning.

crates/boot/src/generators/bls/uki.rs

@@ -62,7 +62,7 @@ impl ReadAt for FileReader {
 /// Finds the `.efi` files in `directory` on `filesystem` and reads their sections.
 /// A missing directory has no images. Files that can't be read as a PE image are skipped,
 /// as one broken file should not prevent booting any of the other entries.
-pub fn scan(filesystem: Handle, directory: &str) -> Result<Vec<UkiFile>> {
+pub fn scan(filesystem: Handle, directory: &str, strict: bool) -> Result<Vec<UkiFile>> {
     let mut fs = uefi::boot::open_protocol_exclusive::<SimpleFileSystem>(filesystem)
         .context("unable to open the unified kernel image filesystem")?;
     let mut root = fs
@@ -112,7 +112,7 @@ pub fn scan(filesystem: Handle, directory: &str) -> Result<Vec<UkiFile>> {
                     .map(|profile| UkiProfileEntry {
                         index: profile.index,
                         has_osrel: profile.sections.contains_key(".osrel"),
-                        entry: BlsEntry::from_uki_profile(&profile, &path),
+                        entry: BlsEntry::from_uki_profile_with(&profile, &path, strict),
                         info: profile.info,
                     })
                     .collect(),