Support for disabling invocation of rescue mode from kernel cmdline

The rescue mode that can be invoked from the kernel command line is
potentially unsafe.  Many systems lock the root user account, or use
another account for managing, e.g. 'admin'.  The sulogin program(s)
would on such systems give the user a root prompt.

In #357 we added support for setting a custom sulogin user, but for some
systems that is not enough.  On many embedded systems the /etc/passwd
and shadow files are populated at bootstrap and at the time rescue mode
runs, these files will be unpopulated.

The only, truly safe, approach on such systems is to disable rescue mode
completely.  Otherwise intricate Finit plugins have to be used that run
before rescue mode is started -- increasing the complexity of the system
as a whole.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

doc/cmdline.md

@@ -86,6 +86,8 @@ The `bool` setting is one of `on, off, true false, 1, 0`.
     the system booted in a limited fallback mode.  See [config.md][]
     for more information.
 
+    This option can be disabled with `configure --without-rescue`
+
     **Note:** in this mode `initctl` will not work.  Correct the problem
     and use `reboot -f` to force reboot.
 

doc/config.md

@@ -1141,6 +1141,10 @@ Finit supports a rescue mode which is activated by the `rescue` option
 on the kernel command line.  See [cmdline docs](cmdline.md) for how to
 activate it.
 
+This rescue mode can be disabled at configure time using:
+
+    configure --without-rescue
+
 The rescue mode comes in two flavors; *traditional* and *fallback*.
 
 > **Note:** in this mode `initctl` will not work.  Use the `-f` flag to