fn write_fsverity_enforcement( out: impl Write, entry: &BootEntry, prefix_len: usize, ) -> Result<()>