turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/wpa_supplicant.age

@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA 10afz8Gsoaz0OhJcU2my2bpsgAWNdMGN9FNo4jWgVm0
-yO9aFe0wbyp/5ZJeo3oK68FV3+C9wmp4o+PeMoRQ9qQ
--> ssh-ed25519 DFiohQ 4VXaRz0iCATfp06eq1hnqKpd45jEGGeD1yMXuusKkTc
-eLQaUgEddJqyFwv8FZY9UufA5htvgYsNOvpNUWkVY/U
--> ssh-ed25519 dLdKaA Mmr7xPZNZpRToQJmXKTJCT1SFNMeqDj8exP3p72iSEI
-ZPlltf6OR2yezsu1m58dx2H1Vr+2Gkh8ZYVEb508Zk8
---- qSi+xziv//Wk/qkyYLkLMFqouti465SB8HxwsjZVmHk
-£žöw�G<ýEaA–|ÂâÉÛlv>nî²Î &(
-!øE3ÒñbB»ä6ï¥�nFð
-OßÚ„B´â	ªsÑC,ÃÀÑd‡ê”Úú§ˆ-“Þí¥ÁltÉ^ê†iºx‚¢§¸è©$²uô1
+-> ssh-ed25519 osOCZA Ep20gMNYxJVHQMDKMp/TnHVy3Zmj/iwWtBfces/6AzQ
+fraHe346gWGZ18nupF+XFFT9aztAJ09HbP6v9MjutLA
+-> ssh-ed25519 DFiohQ UTM2LV9aG34x0hwvjYmY4HeYNUkZIxWbs/VX5/5W/WE
+5pO0tJeI+MIs+MTR90wpHrzPLtJAKQ0VXhF+hAel53M
+-> ssh-ed25519 ao8+sg 7fEP6GCczoek0RFPWoq06TbGnTJImS71p/otSAWR7hA
++QkTcWOBuhQSKFH+eiImuTsk9SGZ2dnU2ZhQS63Ux8A
+--- gGwSfyEQWYSupnY3B4g8fwu9Pp2PpfPNPQ/mvtEpD8E
+ÆvQ6Èôæ‰ãú>“^¥N"Æôÿ�zdùº&Xì÷�u<È:üÔ%�»u|>P¾­¨Èì.—aD×VÖ2LK=�øz¥¸%ÁÜÎõ¤¦[Á!ïæ¾êT� BÕ`7x/Ñd¦9ïN¤«'ïP