Motivation for this change

This adds a NixOS option which enables to configure grub to give the kernel a second ,additional initramfs.

My use case is the following:
I have a LUKS encrypted root filesystem, and no /boot partition. Grub asks me a passphrase to open /, read its configuration in /boot and then loads the kernel.
The initramfs then asks me the same passphrase a second time to mount /.
The solution is to create a LUKS keyfile, readable by root only, and put it in the initramfs so that stage1 doesn't need the passphrase anymore. But because of issue #8 one cannot but secret files in the store and thus in the initramfs.
So I have a second, static initramfs in /boot/custom_initramfs/initramfs.gz, readable by root only, and containing only the keyfile /key and the following setup:

boot.loader.grub = {
...
enableCryptodisk=true;
extraInitrd=/boot/custom_initramfs/initramfs.gz;
};  
boot.initrd.luks.devices = [ { 
...
keyFile="/key";
} ];

Things done

• Tested using sandboxing
  (nix.useSandbox on NixOS,
  or option build-use-sandbox in nix.conf
  on non-NixOS)
• Built on platform(s)
  • NixOS
  • macOS
  • Linux
• Tested compilation of all pkgs that depend on this change using nix-shell -p nox --run "nox-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Fits CONTRIBUTING.md.

Only tested on grub2, although the syntax should be the same with grub1.