upstream sync

we can use a pkcs11 pin now, that's...neat. the zfs stuff is still not upstream, however.

pin down specific OS releases

this will make thinking about the repository easier

in which we check the gh workflow

verifying the clevis builds come out with this tag

adding the dracut-zfs packages

we...kinda needed those to exist, so.

build future clevis with zfs support

this merges in an open PR to add ZFS support. mostly done here as a reference for easier building on.

in which we try to re-run the workflow

no code diffs, really.