Hardening on encrypted partitions (mkfs, first 1MB)

[kdave]

Continuation of #732 that argues that the first empty megabyte (except bootloader, partition table and btrfs superblock) is a potential source of weakness in case the device is encrypted. The contents is all-zeros in known offsets which could aid some types of attacks.

What we can do:

• implement an option to mkfs that will fill known not-live ranges in the first megabyte
• maybe add detection of encrypted devices (we can do that for LVM based on the device names or query DM somehow)
• implement a command that will fill the not-live ranges on already created image (this should also work on a mounted filesystem that changes only the superblock)

Note this cannot prevent the same type of analysis of all-zero blocks beyond the first megabyte based on application workloads or other filesystem behaviour, but it's supposedly removing a trivial case.