turny: fix SPI/GPIO config for newer kernels

- Add complete config.txt settings with u-boot boot lines + spi=on
- Override sdImage.populateFirmwareCommands to use configtxt module output
- Mount firmware partition and add activation script to sync config.txt
- Load spi_bcm2835 and bcm2835_gpiomem kernel modules
- Add udev rule for gpiomem subsystem (not just gpio)
- Relax ProtectKernelTunables so service can access GPIO
- Update turny flake input to rppal-based CS pin fix

secrets/everii-vpn/de1.key.age

@@ -1,9 +1,10 @@
 age-encryption.org/v1
--> ssh-ed25519 osOCZA sGsltqSPiC3jkgZcpRXobfPgKiuPYzU3XiNptcyniB4
-0Q7X+YuaRHT2/1sCrqyhnXCRGIcUKlHQKoo7W8TCwD0
--> ssh-ed25519 DFiohQ o982CBPZ8MYPkm+ngw0WxJKc4vC0yo1poTz3ICnbJVM
-Ac600G8Gr8dhPaXxl8k7A7XpaX70iyLTzfFFTc+14Ag
--> ssh-ed25519 hRPDBg Pf8NvKBZy/afSlFjZIySg6aSregAeMtUCj7e90b0qXw
-kW4Ph56hKVtR0MUaulZpSS28Kna1Wigcvcf1Uv2ESf8
---- Jbu+08V6cvPbTBjwiZvIRtsdOPOtn/e3VCzQuyrCgLw
-®î|xÌ=׺6ú»ÙÄ)ؘjYy6¤Ê`Ø‚ÛØào wÔ¬ËZ€\
LLfK,(œØq¸>AŽ_tM£êqŽü°°£Y‘>Õí
+-> ssh-ed25519 osOCZA ylc8vGyAOgdlAWSFGDQ7rjIoPCXtCgTdjyq7jiJLtF4
+HG7y2EyaHKB9664gfH3Q+YxL2ArAEKIIlwtC8YKtHh8
+-> ssh-ed25519 DFiohQ XPjQk3y/Dmsh8mHqUD3oLdRR9drDB29sCRjoaYlbGkw
+BfGPDs5n1IoYgAZzEgRnmvhxqvY+BrYLVASJOR/szeI
+-> ssh-ed25519 hRPDBg s1AkS3NGpW8yAQwXqx9UgHc2SaiA+AcE4vCbYlHENH0
+e9bhxPNYUct/dQEVirOkX1A+ulPiE1PHGh8M6qrM67k
+--- Ov/CzZKVSYIKK4Z4W5duNQd/Bu9tkMwXhPXhzW9KOjk
+žã«1ÿkVyôG||8ÊÚD„dÙÓòk*ŽÅhɽ~{»Ð1T�,¾?ht%Þ!ƃ§°ýÎÜbÍ·µË¼�ßtÚ
+ø5ÀH{ÿä