systemd

github/workflows: disable persisting credentials for actions/checkout

github/dependabot: set cooldown period

verity: measure all root hashes as we activate to a new NvPCR (#40648)

update TODO

ci: add simple test that ensures the verity nvpcr measurements are made