Change encryption key before flashing

We currently mark the encrypted images as "for evalution only" and expect users to ensure changing keys on their own but it would be better to do that out of the box:

For encrypted images we should change the encryption key similar to

kpartx -a librem5r4.img
# time cryptsetup-reencrypt /dev/mapper/loop0p2 

# cryptsetup luksDump --dump-master-key /dev/mapper/loop1p2 

shows that is actually changed.

Related librem5-devkit-tools!229 (merged) , image-builder#63 (closed)