cdn-patch: adjust geli boot-time unlock behaviour

cdn-patch: adjust geli boot-time unlock behaviour

This patch will cause geli's boot-time unlock code to attempt unlocking
the container using only the preloaded keyfile(s); and only when that
fails will it prompt for a passphrase.

If a container has a keyfile in one slot and a passphrase in the other,
the boot-time unlock code will get confused and assume they are to be
combined, resulting in a container that cannot be unlocked during boot
when its keyfile is preloaded.