turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/storage-box-credentials.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA PDFhOJbsfxCd5u8kqaeCMyFkeAYwRZriF1/OaF/4NU4
-4D63DStz2EiqVqKs75v2WqZb5yFJC6dyNw9g2Ew7flA
--> ssh-ed25519 DFiohQ LedJzIxbcY0X/avsMfMmpFf+bzobyqVQbCJq+EzWiwg
-CNJIzwEETb9fkcnwUD6wSlhVEgXsZCX2vceHVWHC1lA
--> ssh-ed25519 PT7ffg DdwjbqndzOwW9T8KR3HAWuL11UaGLwBLUl9Xistu8WY
-gBJSXMjqYsebwey4b0gT1Xv0FSsw6cLuQ09fOuOaDJQ
---- mcc4EdBkqiYh1L9QQV3wTQCnZDdxqCOLzkp4eNu3TDQ
-!%ÛH0cSô¨ôÀÈ;¥èÙœCmk…<f¥¶–_Yð|ù␍ª72ï•ŒS°Êõ¹ñ€±–ujŒE.¸„Zƒ‚Z„¤Øö]×0–T
+-> ssh-ed25519 osOCZA PQtiqZbb169B6Ovwy86AExmBbrVteTQOFbjnDGJq3UM
+LFCbg+9gFnt4p5xHGHrfJXMJRjSGPPmpXd4pEIFtp2A
+-> ssh-ed25519 DFiohQ RqRirsYRaJ3RRLzvQIOohbF3uX6/5axomxhrO/SAjzA
+jUMEf1YYetb1JWYzeWT4cyT81O36KNm0fN8I5rmuRrE
+-> ssh-ed25519 PT7ffg ISuGZoBIQVdZv/17EKV+MNQHvqSTcj4ChLGvGew4KGQ
+QzjajsmaW+6CQc28cYAOuCLCwFY3c9qP0/uSa4z9yPM
+--- aDY1WIHOhshB9Yfv6tZ9Xip7Ms+88v4D++tGiSSI1A4
+mÎÔr¼&³A@j×
+B¯_W½r»1°½RúÆôv|Ð|ú|·Õd-TD¤VÝ&ÎãƒÍêɧˆøá3sÓŸ(S#*åF¾