Automatically generate recovery passphrase when useful

[ebiggers]

If a user re-installs their system (or otherwise loses the /.fscrypt
directory on the root filesystem) they also lose access to any login
passphrase-protected directories on other filesystems, unless additional
protectors were manually added. This can be unexpected, as it may be
expected that the old login passphrase would still work.

We can't really fix this by storing a login protector on every
filesystem because:

• If a user were to have N login protectors, it would take them N times
  longer to log in, as every login protector would need to be unlocked.

• If a user were to change their login passphrase while any external
  volumes were unmounted, login protectors would get out of sync.

• It's preferable that an external volume isn't unlockable by itself
  using only a login passphrase, as login passphrases are often weak.

Instead, generate a recovery passphrase when creating a login
passphrase-protected directory on a non-root filesystem.

The recovery passphrase is added as a custom_passphrase protector, thus
giving the policy two protectors: one pam_passphrase and one
custom_passphrase. Then this passphrase is written to a file in the new
encrypted directory. Writing the passphrase to a file here is okay
since it's encrypted, but it's obviously useless by itself; it's up to
the user to store this passphrase somewhere else if they need it.

Use a recovery passphrase instead of a "recovery code" that encodes the
policy key directly because a passphrase is more user-friendly: it can
safely be made much shorter than a key, and it works just like any other
fscrypt protector. Also, it's not as critical to allow recovery when
the .fscrypt directory on the same filesystem is deleted.

Update #164

[ebiggers]

This has been out for review for 2 months, and also the recovery passphrase generation is easy to change later if needed. So I'm going ahead and merging this. @josephlr please do take a look later when you have time, though.