turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/gitlab-runner/docker.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA wpN3yvRvjDjs45jISvWHluVYjgt7KBlDBbWubMtgn3U
-SzZZWcc8NpYA08kafMwsvYQWoAsNBN+9AXYxqQmiEkA
--> ssh-ed25519 DFiohQ R2vygwm3+reW5mJTUdFrEhExA0uI3yhHngNhp4hLBRI
-tmY3D32TOK/CMrLlzwE8vYr2vIxYXkcqHPgq/a0QO0M
--> ssh-ed25519 PT7ffg IkM8NFdkSef9sB1LuBB3joDyKNwcJkKa7B30mrCufVk
-nzj1ccl0DU/Ubt6I0PMscftvra0Y4n2gRB7oBtTGoaY
---- OtT3fPqZXKVCWQ/35+9XZMfhtEuUHaio+zxqVBeyJVs
-æ÷Ðc¯�cÛ‰Œ¨©¤i�B©sò8ÐaDJb•,¡åHz-yÕ6lÅNÓ{Ó#•¤&�)x+‚M1¹û‰=ñ,3%»ý8ãX�ªÛª¿î,Øo8ã×Ý¡úªfšÛˆZô˜]ZõoWO›Ã>T
+-> ssh-ed25519 osOCZA Wnc3PL++j3i07tkKyKdfwjUwZEg5tnXQfWW+JhRSIQU
+eOYYoPvzsta+BdGqRGUw60upA7da+xAKkgY5SULrz98
+-> ssh-ed25519 DFiohQ Zw+DAeYPLTSTm64f/xoxaSHaBjfeuX977Hw2xBNLPlc
+pNl3S10RF2N9lcgMtGuodnyaIyGgqC1vuYqyqaeRiJA
+-> ssh-ed25519 PT7ffg KUcvZ2YR4pV1pJrQzIUmEs2U0azDcu/PCxBKaiuYrC0
+EX9rhh1XtpGOWjQ4OzBVxD+hRtRc1caLgB2EJ1isYKg
+--- OUJ/fR74TEgXceG3Dml7d9o0+rzdzUQu83Q3IkW//TY
+Ú6␍ãѱ¤ëÉ<£xi
t¹YWèª!�™út–ß=CÚ;Ù'üéR½ÚÓMŠÖaš—:?(]†–dY·ü<…␍r0ÑD1”ÜOŸAÿˆX‹ÑÅVÍG␍\"îŒzzõ·Ÿ­ÅØúD‹P’Óø