Issue description

c06d795 introduced boot.initrd.secrets, in place of the prior boot.loader.grub.extraInitrd.

While I sincerely appreciate trying to handle this directly, it has four problems that I can see:

0. It arbitrarily breaks working systems
   Not even a deprecation period, just suddenly I can't rebuild.
1. No documentation!
   This seems like it should be a baseline requirement for a feature like this, but instead we removed a documented option in favor of one with no documentation. As a user, I'm extremely disappointed by this.
2. None of the seemingly obvious values worked
   Trying what seem to me the intuitive options didn't work---you can't just give it a file, and you can't just give it an array of files. I read the code, and it appears you must give it an attribute set? I can guess that my keyfile is supposed to be one or the other, but what's the other thing supposed to be?
3. If you read the code and at least guess what is supposed to happen, it doesn't appear to work because it makes assumptions that don't appear to hold on all systems.
   It appears to be assuming things about paths existing.

It seems like this could have stood more review. CC: @joachifm as committer, and @lopsided98 as author.

Steps to reproduce

Add boot.initrd.secrets = { "" = "/luks-root.key"; }; to your /etc/nixos/configuration.nix. Try to rebuild your system, and you'll see this error:

Error getting name to temp file from template /boot/kernels/initrd-secrets.XXXXXXXX: Parent directory (/boot/kernels/) does not exist at /nix/store/rhaqrbjcx5mzd7zq2819x8bm83crwl35-install-grub.pl line 360.

Technical details

Please run nix-shell -p nix-info --run "nix-info -m" and paste the
results.

• system: "x86_64-linux"
• host os: Linux 4.17.0, NixOS, 18.09.git.eddb6f9 (Jellyfish)
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.0
• channels(root): ""
• channels(mdorman): ""
• nixpkgs: /var/nixup/nixpkgs