fips: split loading the crypto modules and checking the kernel
In e54ab383 we moved the fips script to a later pahse of boot, since
the /boot might not be available early on.
The problem is that systemd-cryptsetup* services could be run now
started before the do_fips is executed and need the crypto modules
to decrypted the devices.
So let's split the do_fips and load the module before udev does the
trigger.
patch_name: 0012.patch
present_in_specfile: true
location_in_specfile: 12
squash_commits: true