fips: split loading the crypto modules and checking the kernel
    
    In e54ab383 we moved the fips script to a later pahse of boot, since
    the /boot might not be available early on.
    
    The problem is that systemd-cryptsetup* services could be run now
    started before the do_fips is executed and need the crypto modules
    to decrypted the devices.
    
    So let's split the do_fips and load the module before udev does the
    trigger.
    
    patch_name: 0012.patch
    present_in_specfile: true
    location_in_specfile: 12
    squash_commits: true