turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/glance/reddit/app-secret.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA tO/H34qaDDLUWG7ovv4wD8At0v+nRLxgozIHFRCxIG4
-AU0szD79hzM5rLSYQhki+Ukc2CbATwdU5uWPNLn1Oa0
--> ssh-ed25519 DFiohQ hwThntCOC9a5eSAay4zWW044NoC4JggBXgh3KAZdGAA
-z2EDIRJH9jGTKYuxm++ns1yqFyUYrA091Q22VMNgqec
--> ssh-ed25519 PT7ffg tNGBQvJnGvnGB0Mk24Hyh75ZJAMbZMKk60wkc/PMEiE
-ijewL+qajDYN7abihSAvAySqcx3idkstsriVVw9Fj+A
---- HuLF80Z9VHyeMVTyN9CLKIRn0HFUpIhaWC9KgLHXrlI
-:™Â3ÿö:ïžéÔRàöó1™Ä„É°ŠBÀo�&Qd1BXU¤ìí¨qÑ ßšüÙfÂ�€êQPÝ—8
+-> ssh-ed25519 osOCZA t6j6GnCmxIYZKfYZ+dthOAaJqjHtbsIZSOYaonDvDxo
+KWhOeO95ExUHgcHtm5BYwZnG4EOMZpcKB7h/UM7yxZ8
+-> ssh-ed25519 DFiohQ XlRVp8vYYbCbrCGIYpXLsewZkceQJRqUlegTnAp4gSo
+4yu21bl6xEodz/lVBV/imCresblG89uyz8fzWhSjBJ8
+-> ssh-ed25519 PT7ffg UN3WxuZZrVq4xG/fOYdfyMBBvqO5aKLF+0DZ+8SYjFk
+DSGXD5GeYKIwT/GLG2n16660x3R4JASnzPI0vBvi1kw
+--- mobBb6GglqgnpHy9IaTX6FwjIuv+g31FpC0V4tKJ9mg
+ábwøysqéõfØÖ½Çøâ÷ùE§KvYt&²1ÿ�WzÙì«ÊZ+ɳ×rœ¼	”o·‹ƒŠG