Draft: install/{systemd,sd-encrypt}: only lock the root account when using sd-encrypt

Unless full disk encryption is used, there is not use in "protecting" 🙄 access to the root shell in the initramfs.

The only situation where a locked root account may be desired is when LUKS keys are enrolled in TPM.

This fixes the mess made by:

e6c96788 ("lock the root account in initramfs...") 375bf0c6 ("revert changes, but keep locked root account")

Related to #205