Update the Intel microcode once the root filesystem has been mounted.

Update the Intel microcode once the root filesystem has been mounted.
This depends on the intel-firmware package that contains newer Intel
microcode which will be installed automatically by fw_update(1).

The update should happen much earlier since updating the microcode can
add or remove not only feature flags but also whole features.  For now
only update feature flags that are relevant to Spectre.

Initial diff from sf@
Tested by bluhm@
ok deraadt@