Refactor composefs warnings

[cgwalters]

prepare-root: Drop redundant print about signature/digest

We print if we're doing a signature+digest verification; its absence is
sufficient in the other case. The goal here is to avoid polluting
the logs when signatures are not enabled.

---

prepare-root: Init composefs options earlier

Prep for a later patch.

---

prepare-root: Fold together composefs signature cases

Now that we don't support digest-but-not-signature verification
for composefs, the logic here was unnecessarily complicated.
With a prior prep patch that moved the composefs option
initialization up, we can just have everything related to signature
verification in a single conditonal.

---

composefs: Hard error except on ENOENT even in "optional" case

Since we enabled composefs at build time, the default (non-composefs)
case now always prints
composefs: Optional support failed: No such file or directory
But that's normal and expected.

Rework things here so that in the very special case where
we are in "maybe/optional" mode and we get ENOENT, then we
output a much more normal-looking message that doesn't include
the string "failed".

Now on the flip side - if I have explicitly enabled signature
checking, I think we do want to make that fatal even if
composefs is in "maybe" mode.

(This part is more debatable; perhaps we should just disallow
the case of "maybe" + signatures at all; but I think this is
an improvement in that direction)

---

[cgwalters]

@alexlarsson review ping if you have a bit of capacity, I think this one is quite safe and it passes the tests we have here (though we don't yet cover the signed path in CI)

[cgwalters]

I guess we can hold this one for the next release, since it could use a bit more testing and in the end it's mostly cosmetic.

[cgwalters]

OK release is done, lifting draft here