This is slightly more verbose and inconvenient, but it forces you to think about what the wrapper ownership and permissions will be.
Currently, ecryptfs support is coupled to `security.pam.enableEcryptfs`, but one might want to use ecryptfs without enabling the PAM functionality. This commit splits it out into a `boot.supportedFilesystems` switch.