Add DM_VERITY_VERIFY_ROOTHASH_SIG_FORCE Kconfig option. When enabled, dm-verity always requires a valid root hash signature: require_signatures defaults to true and can no longer be cleared on the command line. When disabled, the existing require_signatures module parameter controls enforcement. Signed-off-by: Ayoub Zaki <ayoub.zaki@embetrix.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>