genprotimg.bu: halt system after firstboot completed

We use CoreOS as base system for the FakeSecureVM, unfortunately
it's not possible to generate 'sdboot' image during `firstboot`,
because ignition checks for unique `boot` labeled fs, but added
as a disk qemu-secex.qcow2 image has its onw 'boot' partition.

Author: nikita-dubrovskii

src/secex-genprotimgvm-scripts/genprotimg.bu

@@ -71,3 +71,16 @@ systemd:
         Options=rw,noatime
         [Install]
         WantedBy=default.target
+    - name: autohalt.service
+      enabled: true
+      contents: |
+        [Unit]
+        Description=Halts system on firstboot
+        ConditionKernelCommandLine=ignition.firstboot
+        After=multi-user.target
+        [Service]
+        Type=oneshot
+        ExecStartPre=/bin/echo "Shutting down"
+        ExecStart=/usr/bin/systemctl --no-block poweroff
+        [Install]
+        WantedBy=multi-user.target