validate detached LUKS header before opening

[smira]

See https://blog.trailofbits.com/2025/10/30/vulnerabilities-in-luks2-disk-encryption-for-confidential-vms/

Basically implement the suggestion - read detached header, validate it, and only proceed to unlock with detached header once it looks good enough.