repart: add EncryptToken= option to register custom LUKS2 token during provisioning time